feat(admin): runtime-editable crawler & analysis config in the dashboard

Move crawler and analysis configuration out of boot-only env vars and into
a DB-backed, admin-editable surface applied live without a restart.

- New `app_settings` table (migration 0026) holds one JSONB row per group;
  env vars seed it on first boot, then the DB is the source of truth.
- `settings.rs` adds serializable Crawler/Analysis DTOs with env-base +
  DB-overlay conversion and field-level validation; env-only/secret fields
  (browser, proxy, TOR, vision API key, PHPSESSID) are never persisted.
- `GET/PUT /api/v1/admin/settings/{crawler,analysis}` (RequireAdmin,
  cookie-only, CSRF-guarded): GET returns the editable DTO + a read-only
  env-managed view + prompt defaults; PUT validates (422 + per-field
  details), persists + audits in one tx, then gracefully respawns the
  affected daemon via a Supervisor.
- AppState swaps the crawler control/resync handles and analysis enable
  gate behind shared runtime cells so reloads take effect with no restart;
  a boot-time spawn failure is logged rather than aborting startup.
- Make the three vision prompts and sampling temperature configurable
  (defaults preserved); cookie_domain is admin-editable too.
- Frontend: tabbed /admin/settings page with grouped fieldsets, prompt
  reset-to-default, env-managed read-only panel, save-&-apply confirm, and
  per-field validation; typed client + ApiError.details.
- Bump version 0.79.1 -> 0.80.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.env.example

@@ -167,3 +167,25 @@ BACKEND_URL=http://backend:8080
 # 25 Mbps; raise for users on slower upstream links or lower if a
 # tighter front proxy already bounds the request lifetime.
 BACKEND_PROXY_TIMEOUT_MS=300000
+
+# ----- Runtime settings (crawler + analysis) -----
+# The crawler and analysis subsystems are configured at runtime from the
+# `app_settings` table and edited live in the admin dashboard
+# (Admin → Settings) — no restart needed. The CRAWLER_* / ANALYSIS_* env
+# vars below act as the BOOT SEED: on first boot (when the row is absent)
+# the env values populate the DB; thereafter the DB is the source of
+# truth and env changes are ignored for those fields.
+#
+# Host/infra and secret fields stay env-ONLY (never persisted, shown
+# read-only in the dashboard): the chromium binary/dir, browser mode/args,
+# CRAWLER_PROXY, all CRAWLER_TOR_CONTROL_*, the cookie domain, and the
+# analysis ANALYSIS_API_KEY. The important site levers (PRIVATE_MODE,
+# ALLOW_SELF_REGISTER) also remain env-only by design.
+#
+# New analysis knobs (all optional, all seed defaults):
+#   ANALYSIS_TEMPERATURE       Sampling temperature. Default 0 (deterministic).
+#   ANALYSIS_SYSTEM_PROMPT     Override the single-call vision system prompt.
+#   ANALYSIS_OCR_PROMPT        Override the tall-page OCR (pass A) prompt.
+#   ANALYSIS_GROUNDING_PROMPT  Override the tags/scene/safety (pass B) prompt.
+# Leave the prompt vars unset to use the built-in defaults (also editable,
+# with a per-prompt "reset to default", in the dashboard).