Add Resend API key to admin-configurable Server secrets

Was only ever settable via .env - now follows the same pattern as
Cloudflare Turnstile: SystemSecretKey.RESEND_API_KEY + a META entry
covers storage/encryption/frontend rendering automatically (the
Settings UI's Server secrets box is fully data-driven off this list).
Wired the register/login/resend-verification/request-password-reset
route handlers to use get_effective_settings so an admin-set key
actually reaches the emails those flows send, not just .env's value.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/api/app/services/system_secret_service.py

@@ -1,10 +1,11 @@
 """Server-wide secrets an admin can configure from the Settings page
-instead of only via .env - today just the Cloudflare Turnstile site key
-and secret (app/services/turnstile_service.py). Storage is encrypted at
-rest (app/core/crypto.py). Unlike per-user API keys
-(user_api_key_service.py), there's exactly one value per key, shared by
-the whole app - visible/editable only to admins (see
-app/api/v1/system.py's require_admin gate), never per-user.
+instead of only via .env - the Cloudflare Turnstile site key and secret
+(app/services/turnstile_service.py) and the Resend API key
+(app/services/security_email_service.py). Storage is encrypted at rest
+(app/core/crypto.py). Unlike per-user API keys (user_api_key_service.py),
+there's exactly one value per key, shared by the whole app -
+visible/editable only to admins (see app/api/v1/system.py's require_admin
+gate), never per-user.
 """
 
 from __future__ import annotations
@@ -35,6 +36,9 @@ META: dict[SystemSecretKey, SecretMeta] = {
     SystemSecretKey.TURNSTILE_SECRET: SecretMeta(
         label="Cloudflare Turnstile Secret Key", settings_field="turnstile_secret"
     ),
+    SystemSecretKey.RESEND_API_KEY: SecretMeta(
+        label="Resend API Key", settings_field="resend_api_key"
+    ),
 }