feat(store): config table for instance-global app-config overrides

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

backend/internal/store/config.go

@@ -0,0 +1,39 @@
+package store
+
+import (
+	"context"
+	"fmt"
+)
+
+// ConfigValues returns every application-configuration override row as
+// key -> value. An absent key means its default (from internal/config's
+// app-key registry) is in effect -- the table stores overrides only.
+func (db *DB) ConfigValues(ctx context.Context) (map[string]string, error) {
+	rows, err := db.QueryContext(ctx, `SELECT key, value FROM config`)
+	if err != nil {
+		return nil, fmt.Errorf("config values: %w", err)
+	}
+	defer rows.Close()
+
+	values := map[string]string{}
+	for rows.Next() {
+		var k, v string
+		if err := rows.Scan(&k, &v); err != nil {
+			return nil, fmt.Errorf("scan config row: %w", err)
+		}
+		values[k] = v
+	}
+	return values, rows.Err()
+}
+
+// SetConfigValue upserts one override row. Key validation is the caller's
+// job (config.ValidateAppValue) -- the store stays a dumb K/V layer.
+func (db *DB) SetConfigValue(ctx context.Context, key, value string) error {
+	if _, err := db.ExecContext(ctx, `
+		INSERT INTO config (key, value, updated_at) VALUES (?, ?, datetime('now'))
+		ON CONFLICT(key) DO UPDATE SET value = excluded.value, updated_at = excluded.updated_at`,
+		key, value); err != nil {
+		return fmt.Errorf("set config %q: %w", key, err)
+	}
+	return nil
+}