feat: instance settings + instance-wide storage cap (backend)

[ravirajsinh45]

Summary

Adds an admin-editable instance_settings singleton table — the foundation for
instance-level settings on this single-tenant, self-hosted deployment — with an
instance-wide total-storage cap as its first setting, enforced at upload time.
Backend only; the admin UI and a real storage indicator are a separate follow-up.

Context: emerged from #64 (configurable per-file cap + removal of a fake per-project
"10 GB" indicator). FreeFrame is single-tenant — one implicit org == the instance —
so an "org-level" cap is really an instance-level cap.

What's added

• InstanceSettings model + migration — single-row table (fixed sentinel PK →
  true singleton), storage_limit_bytes BigInteger (0 = unlimited). Sibling to
  feat: Instance branding — white-label logos, org name, favicon, Powered by FreeFrame #90's instance_branding, kept separate by concern.
• services/storage.py — instance_storage_used_bytes (committed-only usage:
  processing/ready, non-deleted), get_storage_limit, storage_cap_error, and
  upload_guard_error (per-file MAX_UPLOAD_BYTES first, then the instance cap).
• GET /instance/settings (any member → {storage_limit_bytes, storage_used_bytes},
  read-only) and PUT /instance/settings (admin). Per-role curated response;
  storage numbers never exposed to unauthenticated callers.
• Enforcement at both upload-initiate handlers via the shared guard, before the
  MediaFile row is created. Initiate-only (concurrent-burst race documented).
  Per-file env cap unchanged.

Design decisions

• 0 = unlimited everywhere (consistent with MAX_UPLOAD_BYTES).
• One committed-only usage query feeds both the GET indicator and the cap check.
• True singleton via sentinel PK + IntegrityError handling (fails closed under
  concurrent first access).

Testing

• Full backend suite: 86 passed.
• New apps/api/tests/test_instance_settings.py (model, service, router auth/shape,
  enforcement, singleton no-row default).
• Real-Postgres smoke (the mock harness can't execute the SUM):
  instance_storage_used_bytes ran against the dev DB → 13.2 MB; over-cap and
  unlimited branches verified.

Follow-ups (out of scope)

• Frontend: admin settings field + real "used / limit" indicator (replaces the fake
  one removed in UI shows hardcoded "/ 10 GB" project storage cap; backend hard-rejects files > 10 GB #64).
• Automated real-DB integration test for the usage query (test harness is fully mocked).
• Pre-existing: MediaFile.file_size_bytes is Integer (int4, ~2.1 GB/row ceiling) →
  should become BigInteger.
• Align routers/projects.py per-project storage sum to committed-only semantics.
• Alembic heads: this migration and feat: Instance branding — white-label logos, org name, favicon, Powered by FreeFrame #90's branding both chain off 8ca3dffea55f —
  whichever merges second needs an alembic merge.