Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

startos/versions/v0.2.71.ts

@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_71 = VersionInfo.of({
+  version: '0.2.71:0',
+  releaseNotes: {
+    en_US:
+      'Real fix for the "Untitled" library entry bug, after v0.2.70\'s round-trip-the-title fix turned out to be incomplete. Root cause traced: server/index.js\'s relay-mode branch was passing `titleHint: titleSurrogate` to the relay, where `titleSurrogate = itemTitle || "Untitled"`. So when the operator pasted a fresh URL with no client-supplied title, Recap shipped the literal string `"Untitled"` to the relay as the title hint. The relay\'s yt-dlp-fallback gate is `if (!title && audio.title) title = audio.title` — and `!"Untitled"` is FALSE (the string is truthy), so the yt-dlp-extracted title was never used. The relay then echoed `"Untitled"` back in its completion envelope, Recap read it as authoritative, and the library entry persisted as "Untitled" forever — despite yt-dlp having successfully fetched the real video title in the background. Fixed by passing `titleHintRaw = itemTitle ? String(itemTitle).trim() : ""` (raw operator/subscription title only, NOT the surrogate). The provider\'s `title: titleHint || undefined` then correctly omits the field from the JSON body when there\'s no real title, and the relay\'s yt-dlp fallback fires as designed. `titleSurrogate` is still kept around as the display fallback for activity-log messages and for the (rare) case where the relay also can\'t determine a title. Paired with relay 0.2.57\'s defensive normalization (treats both empty string AND literal "Untitled" as "no title supplied") so older Recap clients running pre-0.2.71 also benefit once the relay is upgraded.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})