fix: enforce settings authority boundaries (#618)

Close generic settings authorization bypasses and enforce per-setting authority, validation, redaction, transactional config import, and route-local write rate limiting.

tests/unit/web/admin-security-settings-save-error.test.tsx

@@ -33,12 +33,12 @@ describe("AdminSecuritySettings save errors", () => {
     expect(message).toHaveClass("text-destructive");
   });
 
-  it("lets admins relax the minimum password length down to 1", async () => {
+  it("enforces the API minimum password length of 8", async () => {
     render(<AdminSecuritySettings />);
     await waitFor(() => expect(apiGet).toHaveBeenCalled());
 
     const input = screen.getByLabelText("Minimum Password Length");
-    expect(input).toHaveAttribute("min", "1");
+    expect(input).toHaveAttribute("min", "8");
   });
 
   it("falls back to a generic message when the save rejects with a non-Error value", async () => {

tests/unit/web/settings-payload.test.ts

@@ -4,7 +4,16 @@ import { changedSettings, writableSettings } from "@/lib/settings-payload";
 describe("writableSettings", () => {
   it("strips server-managed read-only keys that the PUT rejects", () => {
     expect(
-      writableSettings({ instance_id: "abc", cookie_secret: "shh", defaultTheme: "dark" }),
+      writableSettings({
+        instance_id: "abc",
+        cookie_secret: "shh",
+        scim_token_hash: "hash",
+        siem_config: "{}",
+        webhook_destinations: "[]",
+        ipAllowlist: "[]",
+        audit_archival_state: "state",
+        defaultTheme: "dark",
+      }),
     ).toEqual({ defaultTheme: "dark" });
   });