feat(settings): add SMTP admin configuration

backend/hermes/alembic/versions/f2b8d4e6a910_create_system_settings.py

@@ -0,0 +1,69 @@
+"""create system settings
+
+Revision ID: f2b8d4e6a910
+Revises: e9a7c3d5b812
+Create Date: 2026-07-04 14:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "f2b8d4e6a910"
+down_revision: Union[str, Sequence[str], None] = "e9a7c3d5b812"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "system_settings",
+        sa.Column("id", sa.Integer(), nullable=False),
+        sa.Column("key", sa.String(length=160), nullable=False),
+        sa.Column("value", sa.Text(), server_default="", nullable=False),
+        sa.Column("is_secret", sa.Boolean(), server_default="false", nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("key"),
+    )
+    op.create_index(op.f("ix_system_settings_key"), "system_settings", ["key"], unique=True)
+
+    op.execute(
+        """
+        INSERT INTO permissions (name, display_name, description, module)
+        VALUES (
+            'system_settings.manage',
+            'Systemeinstellungen verwalten',
+            'SMTP und öffentliche Systemlinks verwalten',
+            'system'
+        )
+        ON CONFLICT (name) DO NOTHING
+        """
+    )
+    op.execute(
+        """
+        INSERT INTO role_permissions (role_id, permission_id)
+        SELECT roles.id, permissions.id
+        FROM roles, permissions
+        WHERE roles.name = 'administrator'
+          AND permissions.name = 'system_settings.manage'
+        ON CONFLICT DO NOTHING
+        """
+    )
+
+
+def downgrade() -> None:
+    op.execute(
+        """
+        DELETE FROM role_permissions
+        WHERE permission_id IN (
+            SELECT id FROM permissions WHERE name = 'system_settings.manage'
+        )
+        """
+    )
+    op.execute("DELETE FROM permissions WHERE name = 'system_settings.manage'")
+    op.drop_index(op.f("ix_system_settings_key"), table_name="system_settings")
+    op.drop_table("system_settings")