Add 'use main stack settings' toggle for third-party integration credentials

Each of Newbook, Resos, SambaPOS, SMTP, and Nextcloud now has a checkbox at the
top of its credentials block. When enabled, the app reads auth credentials from
the central stack settings service (SETTINGS_URL + STACK_INTERNAL_SECRET) and
the local auth fields are grayed out. App-specific fields (base path, GL codes,
keywords, sync intervals, etc.) remain editable regardless.

Backend: new use_global_* columns on kitchen_settings, migration, global_settings_service
with apply_global_overrides() for in-memory credential injection, GET /api/settings/global-status
endpoint, and apply_global_overrides() called in test-connection endpoints and FileArchivalService.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/migrations/add_global_settings_flags.py

@@ -0,0 +1,24 @@
+"""Migration: Add use_global_* flags to kitchen_settings for central stack credential delegation."""
+import asyncio
+from sqlalchemy import text
+from database import engine
+
+
+async def migrate():
+    async with engine.begin() as conn:
+        for col in [
+            "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_smtp BOOLEAN DEFAULT FALSE",
+            "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_nextcloud BOOLEAN DEFAULT FALSE",
+            "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_newbook BOOLEAN DEFAULT FALSE",
+            "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_resos BOOLEAN DEFAULT FALSE",
+            "ALTER TABLE kitchen_settings ADD COLUMN IF NOT EXISTS use_global_sambapos BOOLEAN DEFAULT FALSE",
+        ]:
+            try:
+                await conn.execute(text(col))
+            except Exception:
+                pass
+    print("+ Global settings flags migration complete")
+
+
+if __name__ == "__main__":
+    asyncio.run(migrate())