feat: move configuration from .env to DB with Admin UI management

Replace hardcoded .env configuration with database-backed settings
manageable through the Admin web interface. This reduces .env to
bootstrap-only variables (DB, Keycloak, encryption keys).

Backend:
- Add SystemSetting Prisma model with category, valueType, isSecret
- Add system-settings NestJS module (CRUD, 60s cache, encryption)
- Refactor all 7 connectors to lazy-load credentials from DB via
  CredentialsService.findActiveByType() instead of ConfigService
- Add event-driven credential reload (@nestjs/event-emitter)
- Dynamic CORS origins and conditional Swagger from DB settings
- Fix JWT strategy: use Keycloak JWKS (RS256) instead of symmetric secret
- Add SYSTEM_SETTINGS_VIEW/MANAGE permissions
- Seed 13 default settings (sync intervals, features, branding, CORS)
- Add env-to-db migration script (prisma/migrate-env-to-db.ts)

Frontend:
- Add use-credentials hook (full CRUD for integration credentials)
- Add use-system-settings hook (read/update system settings)
- Wire admin-integrations page to real API (create/update/test/toggle)
- Add admin system-settings page with 4 tabs (Branding, CORS, Sync, Features)
- Fix sidebar double-highlighting with exactMatch flag
- Fix integration detail fallback when API unavailable
- Fix API client to unwrap backend's {success, data} envelope
- Update NEXT_PUBLIC_API_URL to include /v1 version prefix
- Fix activity-widget hydration error
- Add i18n keys for systemSettings (de + en)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/web/messages/de.json

@@ -77,7 +77,8 @@
     "departments": "Abteilungen",
     "overview": "Uebersicht",
     "plentyOne": "PlentyONE",
-    "zulip": "ZULIP"
+    "zulip": "ZULIP",
+    "systemSettings": "Einstellungen"
   },
   "dashboard": {
     "title": "Dashboard",
@@ -1048,5 +1049,29 @@
     "minutes": "Minuten",
     "seconds": "Sekunden",
     "days": "Tage"
+  },
+  "systemSettings": {
+    "title": "Systemeinstellungen",
+    "description": "Globale Anwendungskonfiguration verwalten",
+    "general": "Allgemein",
+    "cors": "CORS",
+    "sync": "Synchronisation",
+    "features": "Features",
+    "branding": "Branding",
+    "appName": "Anwendungsname",
+    "companyName": "Firmenname",
+    "logoUrl": "Logo-URL",
+    "corsOrigins": "Erlaubte Origins",
+    "corsOriginsDesc": "Kommagetrennte Liste von erlaubten Origins fuer Cross-Origin-Anfragen",
+    "syncInterval": "Sync-Intervall",
+    "minutes": "Minuten",
+    "enableSyncJobs": "Hintergrund-Sync-Jobs",
+    "enableSyncJobsDesc": "Automatische Synchronisation der Integrationen im Hintergrund",
+    "enableSwagger": "Swagger API-Dokumentation",
+    "enableSwaggerDesc": "Interaktive API-Dokumentation unter /api/docs verfuegbar (Neustart erforderlich)",
+    "saved": "Einstellungen gespeichert",
+    "saveError": "Fehler beim Speichern der Einstellungen",
+    "requiresRestart": "Aenderung erfordert einen Neustart des Backends",
+    "save": "Speichern"
   }
 }