users.role (first registrant admin), app_settings store plaintext AppId/Secret, admin-only settings API and UI section, runtime credential override in @app/danmaku.