Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

startos/versions/v0.2.76.ts

@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_76 = VersionInfo.of({
+  version: '0.2.76:0',
+  releaseNotes: {
+    en_US:
+      'Recap-app direct-to-Gemini path catches up to recap-relay\'s analyze improvements. Four coupled changes: (1) Gemini analyze calls now pass `responseMimeType: "application/json"` in the generateContent config. Documented Gemini feature that tells the decoder to emit ONLY valid JSON for the response body — eliminates the entire class of "invalid JSON in window response" failures that came from the model wrapping its sections array in a prose preamble, a ```json``` markdown fence, or truncating the closing brace. Mirrors recap-relay 0.2.69. (2) Default analyze retry count bumped 1 → 2 (caller can still override). Analyze is by far the cheapest pipeline phase, so a third total attempt is essentially free in wall time but materially reduces "lost window" failures on transient 503/429 blips. (3) Updated TX and AN prompts to the latest relay-tuned versions. TX prompt now also breaks on "speaker changes" (rule 3) — natural place to start a new line that the recap-relay\'s prompt added during testing. AN prompt switched to the new completeness-aware shape: explicit "every segment index from 0 to N must belong to exactly one section" + "startIndex of section N+1 must equal endIndex of section N plus 1" + "lean toward broad, substantive topics rather than minute-by-minute breakdowns" guidance. The {{windowMin}} and {{targetSections}} concepts that exist on the relay are now baked into the Recap-app code (not exposed as Settings since Recap-app doesn\'t have an operator Settings UI). (4) Per-video-duration section-count target — buildAnalysisPrompt now picks the target total sections based on FULL video duration (under_30 → 6 / 30-60 → 8 / 60-90 → 9 / 90-120 → 10 / 120-150 → 11 / 150-180 → 12 / >=180 → 12) and divides by the effective number of windows to get the per-window target. Splices the resulting "around N sections" / "N–M sections" label into the prompt. Matches recap-relay\'s methodology exactly so segmentation density is consistent across both pipelines. (5) Removed the redundant "Processing… ⬤⬤⬤" status bar that used to sit above the segment-overview pane during transcribe/analyze. The new pizza-tracker breadcrumb in the top row already shows the current stage; the secondary status bar was duplicating signal.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})