feat: superadmin-managed hackathon identity and date settings with onboarding form

[devin-ai-integration]

Summary

Hackathon identity (name, contact/sender email, sender name) and the key dates (applications due, decisions, kickoff) move out of .env / hardcoded frontend constants into the settings table, managed by super admins through a new onboarding dialog. Deployment secrets (SendGrid/SMTP creds, SuperTokens, GCS, Apple Wallet) stay in .env.

Backend:

• internal/store/settings.go gains seven keys backed by two shared helpers, so each setting is a two-line wrapper: getStringSetting/setStringSetting (JSONB string, INSERT ... ON CONFLICT DO UPDATE, unset → "").
• cmd/api/settings.go: GET/POST per setting (dates validated as YYYY-MM-DD), plus GET /superadmin/settings/onboarding-status returning a bool per required setting and an aggregate complete.
• GET /hackathon-config (authenticated, not super-admin gated) exposes the same values to the hacker UI.
• Mailers resolve identity per send instead of at construction, so a rename takes effect without a redeploy; env values remain the boot-time default:

  // mailer
  type identity struct{ defaults Identity; resolver IdentityFunc }
  func (i *identity) resolve() Identity // DB value wins, empty falls back to env default
  // main.go
  mailClient.SetIdentityResolver(func() mailer.Identity { /* reads settings store */ })

• Migration 000026_seed_hackathon_identity_settings seeds the keys as null.

Frontend:

• OnboardingDialog is a standalone Radix dialog with a backdrop-blur-sm overlay and outside-click disabled; it prefills from the eight GETs on open and POSTs all values on submit (reusing ScheduleTab's calendar/parseDateOnly/toDateKey conventions and its ≤7-day range rule).
• OnboardingGate (rendered in AdminLayout) auto-opens it for super_admin when onboarding-status is incomplete; a new Hackathon tab in SettingsDialog shows the per-setting checklist and reopens the same prefilled form.
• Hacker DashboardPage drops IMPORTANT_DATES, "HackUTD 2026", and VITE_CONTACT_EMAIL in favor of /hackathon-config; unset dates are omitted rather than shown as placeholders, and the Contact quick link is hidden until a contact email exists.

Tests: cmd/api/settings_test.go covers name/email/date validation and both onboarding-status branches.

Link to Devin session: https://app.devin.ai/sessions/41cc0f286d00489b97d4b629b73b66c7
Requested by: @balebbae

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring