fix(config): attribute admin system-config writes so they survive restart

[Bccorb]

Closes #97.

Problem

Env-mapped system_config rows are re-seeded from their environment variable on every boot for any row whose updatedBy is NULL. Admin console writes go through the access-token path (auth: 'access' + requireAdmin), which set req.user but never req.clientId; the controllers derived updatedBy only from req.clientId, so it was written as null. The row stayed eligible for env re-seeding, and admin changes (adding an OAuth provider, enabling the oauth login method, editing origins/roles) were silently reverted on the next restart, contradicting the documented contract.

Change (behavior + docs)

• New resolveSystemConfigUpdatedBy(req) helper (src/lib/systemConfigActor.ts): prefers req.clientId (service-token path) and falls back to the acting admin's req.user.id (access-token path). Both PATCH /system-config/admin and the /system-config/oauth-providers endpoints use it, so an admin change now sets updatedBy and becomes authoritative.
• bootstrapSystemConfig.ts: logs a warn when a boot overwrites a stored value that differs from the env-derived one (key and env-var name only, no values), so the reseed is no longer silent.
• docs/configuration.md: the "Environment vs system_config" section (and the top-of-file blockquote) now describe the real, now-guaranteed precedence, including how to hand a row back to env control (clear updatedBy or delete the row).

Note on existing rows

Rows already written before this change still report updatedBy IS NULL, so they remain env-seeded until the next admin write re-attributes them. No data migration is included; that is a deliberate scope choice (call out if a backfill is wanted).

Tests

• Unit (bootstrapSystemConfig.spec.ts): asserts the overwrite warn fires for differing rows and does not fire when the stored value already matches.
• Integration: PATCH /system-config/admin and POST /system-config/oauth-providers now assert upsert is called with updatedBy: 'user-1' (the authenticated admin).

Checks

typecheck, lint, config + systemConfig suites all pass. Security review passed (no findings). Changeset included (minor).