Add multi-tenant cloud mode: self-serve purchase, credit metering, core-decoupling

Introduces RECAP_MODE=multi alongside single-mode self-host:
- Tenant auth + accounts (magic-link via System SMTP), per-tenant credit pool,
  anonymous trial minting with per-IP/-64 caps
- Self-serve Pro/Max purchase: inline Lightning (BTCPay) + card (Zaprite),
  prepaid 30-day periods, expiry-reminder emails
- Core-decoupling: relay owns cloud tier/expiry keyed by Recaps user-id
- SQLite (better-sqlite3) schema for multi-mode; filesystem unchanged for single
- StartOS actions/versions through 0.2.155

startos/versions/v0.2.99.ts

@@ -0,0 +1,13 @@
+import { VersionInfo } from '@start9labs/start-sdk'
+
+export const v_0_2_99 = VersionInfo.of({
+  version: '0.2.99:0',
+  releaseNotes: {
+    en_US:
+      "Mobile sign-up parity + email-recovery for anon credit purchases. (1) The hamburger menu now exposes the Sign up button (opens the Free / Pro / Max tier modal) alongside the existing Sign in entry, matching the desktop toolbar — previously mobile-only visitors had no path to the 3-tier signup. (2) The buy-credits modal now shows an optional 'recovery email' field for anon buyers. When the email is set, the server stashes it on the pending_purchases row, and at signup the new claim-by-email path walks any settled-but-unapplied purchases that match the new user's email and credits them. Fixes the case where the magic-link click lands in a different browser / in-app webview (Gmail iOS, Outlook) than the one that bought the credits — the trial cookie doesn't travel across cookie jars but the email does. 24-hour lookback, anon-buyer rows only, idempotent.",
+  },
+  migrations: {
+    up: async ({ effects }) => {},
+    down: async ({ effects }) => {},
+  },
+})