System Settings Unification: Replace Feature Flags with Typed System Settings

create table ores_variability_system_settings_tbl (
    tenant_id   uuid    not null,
    name        text    not null,
    version     integer not null,
    value       text    not null,
    data_type   text    not null check (data_type in ('boolean','integer','string','json')),
    description text    not null default '',
    modified_by        text not null,
    performed_by       text not null,
    change_reason_code text not null,
    change_commentary  text not null,
    valid_from  timestamp with time zone not null,
    valid_to    timestamp with time zone not null,
    primary key (tenant_id, name, valid_from, valid_to),
    exclude using gist (
        tenant_id            with =,
        name                 with =,
        tstzrange(valid_from, valid_to) with &&
    ),
    check (valid_from < valid_to)
);

create unique index ores_variability_system_settings_version_uniq_idx
    on ores_variability_system_settings_tbl (tenant_id, name, version)
    where valid_to = ores_utility_infinity_timestamp_fn();

create unique index ores_variability_system_settings_name_uniq_idx
    on ores_variability_system_settings_tbl (tenant_id, name)
    where valid_to = ores_utility_infinity_timestamp_fn();

create index ores_variability_system_settings_tenant_idx
    on ores_variability_system_settings_tbl (tenant_id)
    where valid_to = ores_utility_infinity_timestamp_fn();

insert into ores_variability_system_settings_tbl
    (tenant_id, name, value, data_type, description,
     modified_by, performed_by, change_reason_code, change_commentary)
select
    tenant_id,
    name,
    case when enabled = 1 then 'true' else 'false' end,
    'boolean',
    coalesce(description, ''),
    modified_by, performed_by, change_reason_code, change_commentary
from ores_variability_feature_flags_tbl
where valid_to = ores_utility_infinity_timestamp_fn()
on conflict do nothing;

struct system_setting final {
    int version = 0;
    utility::uuid::tenant_id tenant_id = utility::uuid::tenant_id::system();
    std::string name;
    std::string value;
    std::string data_type;   // "boolean" | "integer" | "string" | "json"
    std::string description;
    std::string modified_by;
    std::string change_reason_code;
    std::string change_commentary;
    std::string performed_by;
    std::chrono::system_clock::time_point recorded_at;
};

struct system_setting_definition {
    std::string_view name;
    std::string_view data_type;      // must match check constraint
    std::string_view default_value;
    std::string_view description;
};

constexpr std::array system_setting_definitions = {
    system_setting_definition{
        "system.bootstrap_mode", "boolean", "false",
        "System is in bootstrap mode (no admin exists)"
    },
    system_setting_definition{
        "system.user_signups", "boolean", "true",
        "Allow new user self-registration"
    },
    system_setting_definition{
        "system.signup_requires_authorization", "boolean", "false",
        "New signups require admin approval before activation"
    },
    system_setting_definition{
        "system.disable_password_validation", "boolean", "false",
        "Disable password complexity enforcement (development only)"
    },
    // IAM entries added in the JWT plan PR
};

class system_settings_repository {
public:
    void write(database::context ctx, const domain::system_setting& setting);
    std::vector<domain::system_setting> read_latest(database::context ctx);
    std::vector<domain::system_setting> read_latest(
        database::context ctx, const std::string& name);
    std::vector<domain::system_setting> read_all(database::context ctx);
};

class system_settings_service {
public:
    system_settings_service(database::context ctx, std::string tenant_id);

    void refresh();   // re-reads all settings from DB into cache

    // Raw access
    std::optional<domain::system_setting>
        get(const std::string& name) const;
    void set(domain::system_setting setting);

    // Typed accessors (return default_value from registry if not in DB)
    bool        get_bool   (std::string_view name) const;
    int         get_int    (std::string_view name) const;
    std::string get_string (std::string_view name) const;
    std::string get_json   (std::string_view name) const;

    // Convenience bool setters (matches old system_flags_service API)
    void set_bool(std::string_view name, bool value,
                  std::string modified_by,
                  std::string change_reason_code,
                  std::string change_commentary);

    // Named convenience methods retained for existing callers
    bool is_bootstrap_mode_enabled() const;
    void set_bootstrap_mode(bool enabled, std::string modified_by,
                            std::string change_reason_code,
                            std::string change_commentary);
    bool is_user_signups_enabled() const;
    bool is_signup_requires_authorization() const;
    bool is_password_validation_disabled() const;
};

struct list_settings_request {
    using response_type = list_settings_response;
    static constexpr std::string_view nats_subject =
        "variability.v1.settings.list";
};
struct list_settings_response {
    std::vector<domain::system_setting> settings;
};

struct save_setting_request {
    using response_type = save_setting_response;
    static constexpr std::string_view nats_subject =
        "variability.v1.settings.save";
    domain::system_setting data;
};
struct save_setting_response {
    bool success = false;
    std::string message;
};

struct delete_setting_request {
    using response_type = delete_setting_response;
    static constexpr std::string_view nats_subject =
        "variability.v1.settings.delete";
    std::string name;
};
struct delete_setting_response {
    bool success = false;
    std::string message;
};