refactor(config): mandatory app-config rows seeded in DB; rename to session.setup_timeout

All registry keys must exist as rows in the config table: main seeds
missing keys with their defaults at startup, LoadApp fails fast on a
missing key, and the code-side fallback const/helper for the onboarding
setup timeout is gone -- the value rides in SessionConfig.SetupTimeout.
The key is renamed session.idle_timeout -> session.setup_timeout, and
the /config page's 'overridden' now means 'differs from the default'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/api/session.go

@@ -15,7 +15,13 @@ import (
 type SessionConfig struct {
 	Secret   []byte
 	Duration time.Duration
-	Secure   bool
+	// SetupTimeout evicts an unfinished onboarding Garmin setup session
+	// once idle this long (app-config key session.setup_timeout, minutes;
+	// distinct from Duration, the login cookie lifetime). Mandatory --
+	// there is no code fallback; the default lives in the DB, seeded at
+	// startup.
+	SetupTimeout time.Duration
+	Secure       bool
 	// BackendURL is this app's own externally reachable origin (e.g.
 	// "https://geniusrun.example.com", no trailing slash) -- derives
 	// OIDCRedirectURL (config.Config), the only thing that must stay pointed