Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

startos/versions/v0.2.66.ts

@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_66 = VersionInfo.of({
+  version: '0.2.66:0',
+  releaseNotes: {
+    en_US:
+      'Recap Relay mode: unified single-call pipeline + UI consolidation. (1) Provider picker collapsed into a two-mode chooser at the top: [Recap Relay] vs [Custom Provider / Local]. Picking Recap Relay means the operator\'s relay does the WHOLE pipeline (download + transcribe + analyze) server-side — one credit per summary, no per-step configuration needed. Picking Custom unlocks two independent per-step pickers (Gemini, Claude, OpenAI, local OpenAI-compatible, Ollama, Whisper); the relay is intentionally no longer offered for individual steps because mixing relay-for-one-step with direct-for-the-other left credit accounting in a muddy state. (2) Relay mode now calls the new POST /relay/summarize-url endpoint (requires Recap Relay v0.2.33+) instead of the old transcribeUrl + N-times-analyze fan-out. The browser receives the same SSE events (transcript_ready, sections_partial, result) it always has, so incremental rendering is unchanged from the user\'s POV — but under the hood the transcript never has to leave the relay just for Recap to slice it into 12 prompts and ship them back. Saves ~12 round-trips per long video and lets the operator\'s Settings-tab chunking knobs actually drive production behavior. (3) Migration: existing localStorage entries with both pickers set to relay → land in the new "Recap Relay" mode automatically. Anything else → "Custom Provider" mode, with any stale per-step "relay" picks bumped to the first non-relay alternative so the saved config remains valid. No data loss; no user action required after upgrade. (4) Operators running an older relay (<0.2.33) will see relay-mode jobs fail with a clear "old relay version — re-install relay 0.2.33 or newer" error message rather than a generic 404 — switch to Custom mode while you wait for the operator to upgrade.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})