Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

server/test/util.test.js

@@ -207,7 +207,11 @@ describe("retryGemini", () => {
       },
       { retries: 2, delayMs: 1, label: "test", log: (msg) => logs.push(msg) }
     ).catch(() => {});
-    assert.equal(logs.length, 1);
+    // retries: 2 → the loop logs twice: the "failed, retrying in …s" notice
+    // before attempt 2's wait, then "Retrying… (attempt 2/2)" at the top of
+    // attempt 2. (The test previously expected 1, written before the
+    // top-of-attempt retry line existed.)
+    assert.equal(logs.length, 2);
     assert.match(logs[0], /test/);
     assert.match(logs[0], /retrying/);
   });