feat(admin): runtime-editable crawler & analysis config in the dashboard

Move crawler and analysis configuration out of boot-only env vars and into
a DB-backed, admin-editable surface applied live without a restart.

- New `app_settings` table (migration 0026) holds one JSONB row per group;
  env vars seed it on first boot, then the DB is the source of truth.
- `settings.rs` adds serializable Crawler/Analysis DTOs with env-base +
  DB-overlay conversion and field-level validation; env-only/secret fields
  (browser, proxy, TOR, vision API key, PHPSESSID) are never persisted.
- `GET/PUT /api/v1/admin/settings/{crawler,analysis}` (RequireAdmin,
  cookie-only, CSRF-guarded): GET returns the editable DTO + a read-only
  env-managed view + prompt defaults; PUT validates (422 + per-field
  details), persists + audits in one tx, then gracefully respawns the
  affected daemon via a Supervisor.
- AppState swaps the crawler control/resync handles and analysis enable
  gate behind shared runtime cells so reloads take effect with no restart;
  a boot-time spawn failure is logged rather than aborting startup.
- Make the three vision prompts and sampling temperature configurable
  (defaults preserved); cookie_domain is admin-editable too.
- Frontend: tabbed /admin/settings page with grouped fieldsets, prompt
  reset-to-default, env-managed read-only panel, save-&-apply confirm, and
  per-field validation; typed client + ApiError.details.
- Bump version 0.79.1 -> 0.80.0.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/api/client.ts

@@ -25,14 +25,19 @@ export class ApiError extends Error {
     constructor(
         public readonly status: number,
         public readonly code: string,
-        message: string
+        message: string,
+        /** The error envelope's `details` payload, when present (e.g. the
+         *  per-field `{ fields: [...] }` of a `validation_failed` response). */
+        public readonly details?: unknown
     ) {
         super(message);
         this.name = 'ApiError';
     }
 }
 
-type ErrorEnvelope = { error?: { code?: unknown; message?: unknown } };
+type ErrorEnvelope = {
+    error?: { code?: unknown; message?: unknown; details?: unknown };
+};
 
 /**
  * Optional hook fired the first moment `request()` observes a 401 on
@@ -59,6 +64,7 @@ export async function request<T>(path: string, init?: RequestInit): Promise<T> {
     if (!res.ok) {
         let code = 'http_error';
         let message = `${res.status} ${res.statusText}`;
+        let details: unknown;
         const ct = res.headers.get('content-type') ?? '';
         try {
             if (ct.includes('application/json')) {
@@ -70,6 +76,9 @@ export async function request<T>(path: string, init?: RequestInit): Promise<T> {
                     if (typeof body.error.message === 'string' && body.error.message) {
                         message = body.error.message;
                     }
+                    if (body.error.details !== undefined) {
+                        details = body.error.details;
+                    }
                 }
             } else {
                 const text = await res.text();
@@ -88,7 +97,7 @@ export async function request<T>(path: string, init?: RequestInit): Promise<T> {
                 console.error('on401 hook threw:', e);
             }
         }
-        throw new ApiError(res.status, code, message);
+        throw new ApiError(res.status, code, message, details);
     }
     // Any empty body (not just 204) returns undefined — the manga-add
     // endpoint, for instance, signals create-vs-already-present via