fix: enforce settings authority boundaries (#618)

Close generic settings authorization bypasses and enforce per-setting authority, validation, redaction, transactional config import, and route-local write rate limiting.

tests/e2e/rbac-full.spec.ts

@@ -328,7 +328,7 @@ base.describe("RBAC Full — Custom Role User", () => {
       const writeRes = await fetch(`${API}/api/v1/settings`, {
         method: "PUT",
         headers: authJson(bearerToken),
-        body: JSON.stringify({ testSetting: "hacked" }),
+        body: JSON.stringify({ defaultTheme: "dark" }),
       });
       expect(writeRes.status).toBe(403);