Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

startos/versions/v0.2.91.ts

@@ -0,0 +1,12 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_91 = VersionInfo.of({
+  version: '0.2.91:0',
+  releaseNotes: {
+    en_US: 'Reversible mode-switching + Sign up button for anon. Fixed a bug where switching multi→single mode would hide the operator\'s library: pre-0.2.91 the first multi-mode signup renamed /data/history/owner/ → /data/history/<admin_user_id>/, so single-mode (which always reads "owner") couldn\'t find it after the flip. Now admin\'s library scope is always "owner" regardless of mode, and a one-time boot fixup renames the legacy admin folder back to owner/ on upgraded installs. Mode switching is now fully reversible — admin keeps their library either way; other tenants\' libraries persist on disk while multi-mode is off and reappear when it\'s flipped back on. Anon visitors now see TWO pills in the header — "Sign up" (purple CTA) and "Sign in" (muted) — both going to /auth.html with an intent= query param so the page H1 reads "Create your account" or "Sign in" appropriately.',
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})