Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

Dockerfile

@@ -26,6 +26,18 @@ WORKDIR /app/server
 COPY server/package.json server/package-lock.json* ./
 RUN npm ci --omit=dev --ignore-scripts 2>/dev/null || npm install --omit=dev --ignore-scripts
 
+# better-sqlite3 is a native (C++) module — `--ignore-scripts` above
+# skips the postinstall hook that fetches its prebuilt binary for our
+# platform. Rebuild it explicitly so prebuild-install runs. python3 +
+# make + g++ are the fallback toolchain if no prebuilt matches (e.g.
+# on uncommon arches); on linux-x64/arm64 the prebuild downloads in
+# seconds and the compiler is never invoked. This stage is discarded
+# from the final image, so the install footprint doesn't matter.
+RUN apt-get update && apt-get install -y --no-install-recommends \
+      python3 make g++ \
+  && npm rebuild better-sqlite3 \
+  && rm -rf /var/lib/apt/lists/*
+
 # ── Stage 2: Final runtime image ───────────────────────────
 FROM node:20-slim AS runner