refactor(config): mandatory app-config rows seeded in DB; rename to session.setup_timeout

All registry keys must exist as rows in the config table: main seeds
missing keys with their defaults at startup, LoadApp fails fast on a
missing key, and the code-side fallback const/helper for the onboarding
setup timeout is gone -- the value rides in SessionConfig.SetupTimeout.
The key is renamed session.idle_timeout -> session.setup_timeout, and
the /config page's 'overridden' now means 'differs from the default'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/api/config.go

@@ -22,23 +22,27 @@ type configEntry struct {
 	Description string `json:"description"`
 }
 
-// configView assembles the GET/PUT response: registry defaults overlaid
-// with DB overrides, plus the env snapshot.
+// configView assembles the GET/PUT response: every registry key with its
+// stored value (the DB is fully seeded with defaults at startup; the
+// registry default only fills in here for a key added since the last
+// boot, e.g. under httptest where main's seeding never ran), plus the env
+// snapshot. Overridden means "differs from the default", since every key
+// always has a row.
 func (s *Server) configView(r *http.Request) (map[string]any, error) {
-	overrides, err := s.DB.ConfigValues(r.Context())
+	values, err := s.DB.ConfigValues(r.Context())
 	if err != nil {
 		return nil, err
 	}
 	registry := config.AppRegistry()
 	app := make([]configEntry, 0, len(registry))
 	for _, k := range registry {
-		value, overridden := overrides[k.Key]
-		if !overridden {
+		value, ok := values[k.Key]
+		if !ok {
 			value = k.Default
 		}
 		app = append(app, configEntry{
 			Key: k.Key, Value: value, Default: k.Default,
-			Overridden: overridden, Description: k.Description,
+			Overridden: value != k.Default, Description: k.Description,
 		})
 	}
 	envVars := s.EnvVars