feat(config): effective config via ArcSwap + DB overlay at boot (Stage 2)

Wire the settings overlay into the live config path:
- AppState.config: Config -> Arc<ArcSwap<Config>> (hot-swappable effective config) +
  config_base: Arc<Config> (immutable env-only). New AppState::cfg() accessor; every
  config read goes through it (state.cfg().field), so a runtime-safe operator edit is
  seen on the next request. One Config type, no parallel path.
- Boot (main.rs): load_settings_overlay -> Config::apply_overlay(validate) -> build
  every client/worker/router from the EFFECTIVE config. A persisted overlay that no
  longer validates is ignored (boot env-only + loud log), never bricks. Env-only when
  ADMIN_KEY_INTEGRITY_SECRET is unset.
- Migrated ~59 state.config.X reads to state.cfg().X across api/*; bound guards where a
  reference outlives the statement; integrity_secret returns owned String.
- Test harness builds AppState with ArcSwap + config_base (arc-swap dev-dep).

Behavior-preserving: with no operator_settings rows, effective == env config.
cargo check --all-targets clean; lib tests 256/0.

src/api/premium.rs

@@ -52,7 +52,7 @@ pub struct StatusResp {
 
 /// Reject when the premium tier is not enabled on this instance.
 fn ensure_enabled(state: &AppState) -> Result<(), AppError> {
-    if state.config.premium.enabled {
+    if state.cfg().premium.enabled {
         Ok(())
     } else {
         Err(AppError::ValidationError(
@@ -83,8 +83,8 @@ pub async fn invoice(
     let user_id = extract_user_id_from_token(&state, &headers).await?;
     ensure_enabled(&state)?;
 
-    let plan = state
-        .config
+    let cfg = state.cfg();
+    let plan = cfg
         .premium
         .plans
         .iter()
@@ -106,8 +106,8 @@ pub async fn invoice(
         .as_ref()
         .ok_or_else(|| AppError::Internal("payment provider not configured".into()))?;
 
-    let pay = &state.config.registration.payment;
-    let currency = state.config.premium.currency.clone();
+    let pay = &state.cfg().registration.payment;
+    let currency = state.cfg().premium.currency.clone();
     let invoice = provider
         .create_invoice(&InvoiceRequest {
             amount: plan.amount.clone(),