feat: instance-level streaming limits with admin settings panel

Add a server-side instance_settings table (single-row, CHECK(id=1))
that stores admin-configurable streaming bounds: bitrate min/max/step,
allowed resolutions, and allowed framerates.

Backend:
- New instance_settings schema + migrations (is_admin on users, default
  settings row, first-registered-user promoted to admin)
- GET/PATCH /api/settings/streaming endpoints with admin-only writes
  and full input validation including cross-field checks

Frontend:
- settingsStore fetches limits on WebSocket ready, exposes isAdmin flag
- ScreenShareSettingsPopover reads bounds from store instead of
  hardcoded constants, auto-clamps stale localStorage values
- buildScreenShareOptions() clamps bitrate to server limits at build
  time as enforcement backstop
- ServerSettings modal gains a "Streaming" tab (admin-only) with
  bitrate range sliders, resolution/framerate toggles, and save/reset

packages/web/src/api/client.ts

@@ -25,6 +25,7 @@ import type {
   CreateDmMessageRequest,
   Friend,
   FriendRequest,
+  InstanceStreamingLimits,
 } from '@opencord/shared';
 
 const BASE_URL = '/api';
@@ -193,4 +194,10 @@ export const api = {
     dmToken: (dmChannelId: string) =>
       request<LiveKitTokenResponse>('POST', '/livekit/token', { dmChannelId }),
   },
+
+  settings: {
+    getStreaming: () => request<InstanceStreamingLimits>('GET', '/settings/streaming'),
+    updateStreaming: (data: Partial<InstanceStreamingLimits>) =>
+      request<InstanceStreamingLimits>('PATCH', '/settings/streaming', data),
+  },
 };