PR17: Configuration Write Path + Safe Key Editing

[DMontgomery40]

Summary

Implements safe configuration editing with full audit trail and cache invalidation for Phase 3.

Changes

Backend Core

• ✅ HierarchicalConfigProvider.set() - Complete CRUD for all hierarchy levels
• ✅ Fernet encryption for sensitive configuration values
• ✅ Audit trail with masked values and HMAC integrity checking
• ✅ Cache invalidation patterns for different hierarchy scopes
• ✅ Validation framework against SAFE_EDIT_KEYS constraints

API Layer

• ✅ POST /admin/config/v4/set endpoint with comprehensive validation
• ✅ V4ConfigSetIn/V4ConfigSetOut Pydantic models
• ✅ Error handling for validation failures and constraint violations
• ✅ AdminAPIClient.v4SetConfig() method for frontend integration

UI Enhancement

• ✅ Inline editing controls for safe configuration keys only
• ✅ Level selector for targeting specific hierarchy levels (global, tenant, dept, group, user)
• ✅ Real-time validation with constraint display
• ✅ Save/Cancel workflow with proper loading states and confirmations
• ✅ Type coercion for boolean/integer values in form inputs

Key Features

Hierarchy Support

• Global Level: System-wide defaults (no level_id required)
• Tenant Level: Tenant-specific overrides (requires tenant_id)
• Department Level: Department within tenant (requires tenant_id:department format)
• Group Level: Group-specific settings (requires group_id)
• User Level: User-specific overrides (requires user_id)

Security & Audit

• Only SAFE_EDIT_KEYS can be modified via Admin Console
• All changes create audit records with IP, user agent, and reason
• Encrypted storage for sensitive configuration values using Fernet
• HMAC verification for audit trail integrity
• Masked values in audit logs prevent secret exposure

Performance

• Intelligent cache invalidation based on hierarchy scope affected
• Pattern-based cache clearing for efficient cache management
• Redis + memory fallback for distributed caching

Technical Implementation

Database Schema

• Configuration stored encrypted in hierarchy-specific tables
• Audit records track all changes with masked values
• HMAC ensures audit trail integrity

Cache Strategy

• Global changes: Invalidate all user effective configs
• Tenant changes: Invalidate configs for users in that tenant
• User changes: Invalidate only that user's effective config

Testing Verified

• ✅ Safe key validation prevents editing dangerous keys
• ✅ Constraint validation enforces min/max values
• ✅ Hierarchy resolution works correctly after updates
• ✅ Cache invalidation clears appropriate patterns
• ✅ Audit records created for all changes
• ✅ UI editing workflow functions properly

Dependencies

• Uses existing database models from PR16
• Uses existing cache infrastructure from PR16
• Compatible with existing v4 config API endpoints

Next Steps

• PR18: SSE diagnostics with real-time config change events
• PR19: Provider health monitoring with config-driven thresholds

Built on PR16 foundation, targeting PR16 branch for integration.

[DMontgomery40]

Closing PR17 due to extensive merge conflicts. The core functionality has been implemented and merged via PR16 and PR18. The configuration write functionality will be implemented in a follow-up PR if needed.