refactor(config): mandatory app-config rows seeded in DB; rename to session.setup_timeout

All registry keys must exist as rows in the config table: main seeds
missing keys with their defaults at startup, LoadApp fails fast on a
missing key, and the code-side fallback const/helper for the onboarding
setup timeout is gone -- the value rides in SessionConfig.SetupTimeout.
The key is renamed session.idle_timeout -> session.setup_timeout, and
the /config page's 'overridden' now means 'differs from the default'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/api/api_test.go

@@ -25,11 +25,12 @@ import (
 func newCtx() context.Context { return context.Background() }
 
 var testSessionConfig = SessionConfig{
-	Secret:      []byte("test-session-secret-at-least-32-bytes-long"),
-	Duration:    time.Hour,
-	Secure:      false,
-	BackendURL:  "https://geniusrun.example.com",
-	FrontendURL: "https://app.geniusrun.example.com",
+	Secret:       []byte("test-session-secret-at-least-32-bytes-long"),
+	Duration:     time.Hour,
+	SetupTimeout: 15 * time.Minute,
+	Secure:       false,
+	BackendURL:   "https://geniusrun.example.com",
+	FrontendURL:  "https://app.geniusrun.example.com",
 }
 
 func newTestServer(t *testing.T) (*Server, *store.DB, int64) {