Add Resend API key to admin-configurable Server secrets

Was only ever settable via .env - now follows the same pattern as
Cloudflare Turnstile: SystemSecretKey.RESEND_API_KEY + a META entry
covers storage/encryption/frontend rendering automatically (the
Settings UI's Server secrets box is fully data-driven off this list).
Wired the register/login/resend-verification/request-password-reset
route handlers to use get_effective_settings so an admin-set key
actually reaches the emails those flows send, not just .env's value.

Co-Authored-By: Claude Sonnet 5 <[email protected]>

apps/web/app/(app)/settings/page.tsx

@@ -401,7 +401,8 @@ function ServerSecretsBox() {
         <KeyRound className="h-4 w-4" aria-hidden /> Server secrets
       </div>
       <p className="mt-1 text-sm text-slate-500">
-        Server-wide configuration shared by every visitor, used for Cloudflare Turnstile CAPTCHA.
+        Server-wide configuration shared by every visitor: Cloudflare Turnstile CAPTCHA and the
+        Resend API key used for transactional security email.
       </p>
 
       {isLoading ? (