refactor(config): mandatory app-config rows seeded in DB; rename to session.setup_timeout

All registry keys must exist as rows in the config table: main seeds
missing keys with their defaults at startup, LoadApp fails fast on a
missing key, and the code-side fallback const/helper for the onboarding
setup timeout is gone -- the value rides in SessionConfig.SetupTimeout.
The key is renamed session.idle_timeout -> session.setup_timeout, and
the /config page's 'overridden' now means 'differs from the default'.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/store/config.go

@@ -5,9 +5,10 @@ import (
 	"fmt"
 )
 
-// ConfigValues returns every application-configuration override row as
-// key -> value. An absent key means its default (from internal/config's
-// app-key registry) is in effect -- the table stores overrides only.
+// ConfigValues returns every application-configuration row as key ->
+// value. The table holds a row for every registry key: main seeds missing
+// keys with their defaults at startup, so downstream code never needs a
+// code-side fallback.
 func (db *DB) ConfigValues(ctx context.Context) (map[string]string, error) {
 	rows, err := db.QueryContext(ctx, `SELECT key, value FROM config`)
 	if err != nil {

backend/internal/store/schema.sql

@@ -252,11 +252,13 @@ CREATE TABLE sync_runs (
     error_message      TEXT
 );
 
--- Application configuration: instance-global key/value overrides, shared
+-- Application configuration: instance-global key/value settings, shared
 -- by every user -- deliberately the one table with no user_id, because
--- application configuration is common to all users by definition. Stores
--- overrides only; defaults live in internal/config's app-key registry.
--- Cold: read once at startup, a change applies on the next backend restart.
+-- application configuration is common to all users by definition. Every
+-- key in internal/config's app-key registry is mandatory here: missing
+-- rows are seeded with their defaults at startup (cmd/geniusrund), so
+-- there are no code-side fallbacks. Cold: read once at startup, a change
+-- applies on the next backend restart.
 CREATE TABLE config (
     key        TEXT PRIMARY KEY,
     value      TEXT NOT NULL,