Store scope - support instance / group / project scopes

Problem

Signatures are currently stored per project. This forces users to sign the CLA for every project. Some organisations require an instance-wide signature covering all projects (or a set of project groups).

Proposal

Add a configurable storage scope: instance, group, or project. Keep project as the default to preserve current behavior. Expose installer flags and batch-manifest fields to select scope. When a broader scope is used, record source_project_id for traceability in signature records. A script could be provided to split/merge existing signatures when store scope has changed.

Impact

Improves UX for organisations that want a single signature across multiple projects. Implementation affects architecture and permissions (tokens, webhooks, store placement) and requires careful design.

Related to #17 (moved)