feat(admin): add system_settings audit history (#3002)

[bokelley]

Closes #3002

Summary

Adds a complete audit trail for all system_settings changes — the pre-existing gap flagged in the #3000 security review.

Migration 426_system_settings_audit.sql: new append-only system_settings_audit(id, key, old_value JSONB, new_value JSONB NOT NULL, changed_by, changed_at NOT NULL) table with indexes on key, changed_by, and changed_at DESC.

setSetting rewrite: replaced the plain two-query (SELECT + UPSERT) approach with a single writable CTE that atomically captures the pre-update value, runs the UPSERT, and inserts the audit row — one round-trip, no TOCTOU gap.

New getSettingAuditHistory(limit): DB helper with a Math.min/max clamp (1–200) to prevent unbounded queries.

New GET /api/admin/settings/audit endpoint (requireAuth + requireAdmin), returns last 50 entries.

admin-settings.html updates:

• "Recent changes" section at the bottom of the page renders the audit table (Setting / Changed by / When / New value) on load and refreshes after every save.
• Added the editorial and announcement channel UI sections that were present in the backend but missing from the frontend.

Non-breaking justification: pure addition — new table, new INSERT side-effect in setSetting (callers are unaffected), new read endpoint, new UI section. No existing field or behavior changed.

Expert consensus: internal-tools-strategist and security-reviewer both reviewed; both approved. Key design requirements from review both incorporated: writable CTE for atomicity (vs. separate SELECT + UPSERT), and NOT NULL on changed_at.

old_value not shown in the UI table: intentional — the "Recent changes" panel is a quick-glance "who changed what" view. Full diff (old vs. new) is available via the API for any admin who needs it; the data is fetched and stored.

Session: https://claude.ai/code/session_01FGtbRG15ixXm4FNtSpaqkg

---

Generated by Claude Code

[github-actions]

All contributors have agreed to the IPR Policy. Thank you!
_{Posted by the CLA Assistant Lite bot.}