feat(settings): report which saved keys need a restart

Every settings update answered with a bare success, so the console could not
tell a change that took effect at once from one written to the file that the
running program would keep ignoring until it was restarted — the listener
address, the storage paths, the Komari dashboard URL.

Classify the patch instead. config.RestartRequiredKeys expands a patch into the
dot-separated paths of its leaves and intersects them with the settings main
reads before it starts serving, and the settings endpoint returns that list as
data.restartRequired. It is a pure function of the patch, so UpdateSettings
keeps its signature and nothing else has to change; the write succeeds either
way, and the field only says which edits are not live.

Matching is by overlap rather than equality, so a patch that names a section —
replacing it, or deleting it with a null — reports the startup-only keys inside
it, while a sibling subtree like webhook.endpoints is not mistaken for
webhook.enabled.

The result is never nil, so an update with nothing to report serializes as []
rather than null and a client can iterate it without a guard.

The console reads the field in ConfigSection and warns instead of confirming,
naming the keys that are pending; Settings.vue's hints for the Komari URL, the
listen address and the storage paths now say which of their fields is affected
rather than labelling the whole card.

handler/settings_test.go

@@ -0,0 +1,128 @@
+package handler
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strconv"
+	"strings"
+	"testing"
+	"time"
+
+	"nukumizu-backend/config"
+	"nukumizu-backend/global"
+)
+
+// tempConfigFile points one of the settings paths at a throwaway file, so a
+// test can drive the settings API without touching the config files in the
+// working directory.
+func tempConfigFile(t *testing.T, field *string, content string) {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.json")
+	if err := os.WriteFile(path, []byte(content), 0o644); err != nil {
+		t.Fatalf("write temp config: %v", err)
+	}
+	original := *field
+	*field = path
+	t.Cleanup(func() { *field = original })
+}
+
+// settingsSetRequest builds an authenticated POST for the settings endpoint.
+func settingsSetRequest(t *testing.T, settingsType, body string) *http.Request {
+	t.Helper()
+	req := httptest.NewRequest(
+		http.MethodPost,
+		"/api/settings/set?type="+settingsType,
+		strings.NewReader(body),
+	)
+	req.Header.Set("X-Token", "test-admin-token")
+	req.Header.Set("X-Timestamp", strconv.FormatInt(time.Now().Unix(), 10))
+	return req
+}
+
+// settingsSetResponse is the envelope /api/settings/set answers with.
+type settingsSetResponse struct {
+	Success bool `json:"success"`
+	Data    struct {
+		Type            string   `json:"type"`
+		RestartRequired []string `json:"restartRequired"`
+	} `json:"data"`
+}
+
+func decodeSettingsSetResponse(t *testing.T, w *httptest.ResponseRecorder) settingsSetResponse {
+	t.Helper()
+	var body settingsSetResponse
+	if err := json.Unmarshal(w.Body.Bytes(), &body); err != nil {
+		t.Fatalf("decode response: %v; body=%s", err, w.Body.String())
+	}
+	return body
+}
+
+// TestSettingsSetReportsStartupOnlyKeys covers the field the console reads to
+// tell the user which of their edits are not live yet.
+func TestSettingsSetReportsStartupOnlyKeys(t *testing.T) {
+	setupAdminToken()
+	tempConfigFile(t, &global.ConfigPath.Global, `{"system":{"debugMode":false,"listenPort":"8080"}}`)
+
+	w := httptest.NewRecorder()
+	SettingsSetHandler(w, settingsSetRequest(t, "global",
+		`{"system":{"listenPort":"9090","debugMode":true}}`))
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", w.Code, w.Body.String())
+	}
+	body := decodeSettingsSetResponse(t, w)
+	if !body.Success {
+		t.Fatalf("not a success envelope: %s", w.Body.String())
+	}
+	if body.Data.Type != "global" {
+		t.Errorf("data.type = %q, want global", body.Data.Type)
+	}
+	if len(body.Data.RestartRequired) != 1 || body.Data.RestartRequired[0] != "system.listenPort" {
+		t.Errorf("restartRequired = %v, want [system.listenPort]", body.Data.RestartRequired)
+	}
+
+	// Being reported as startup-only must not stop the write.
+	data, err := config.GetSettings(config.SettingGlobal)
+	if err != nil {
+		t.Fatalf("GetSettings: %v", err)
+	}
+	for _, want := range []string{`"listenPort": "9090"`, `"debugMode": true`} {
+		if !strings.Contains(string(data), want) {
+			t.Errorf("the patch was not applied, missing %s:\n%s", want, data)
+		}
+	}
+}
+
+// TestSettingsSetRestartRequiredIsAlwaysAnArray pins the shape a client
+// iterates over: an update with nothing to report must answer [] and not null.
+func TestSettingsSetRestartRequiredIsAlwaysAnArray(t *testing.T) {
+	setupAdminToken()
+	tempConfigFile(t, &global.ConfigPath.Global, `{"system":{"debugMode":false}}`)
+
+	w := httptest.NewRecorder()
+	SettingsSetHandler(w, settingsSetRequest(t, "global", `{"system":{"debugMode":true}}`))
+
+	if w.Code != http.StatusOK {
+		t.Fatalf("status = %d, body = %s", w.Code, w.Body.String())
+	}
+	if !strings.Contains(w.Body.String(), `"restartRequired":[]`) {
+		t.Errorf("restartRequired should serialize as an empty array: %s", w.Body.String())
+	}
+}
+
+// TestSettingsSetRejectsUnknownType keeps the failure path intact now that the
+// success path computes an extra field.
+func TestSettingsSetRejectsUnknownType(t *testing.T) {
+	setupAdminToken()
+	tempConfigFile(t, &global.ConfigPath.Global, `{}`)
+
+	w := httptest.NewRecorder()
+	SettingsSetHandler(w, settingsSetRequest(t, "nonsense", `{}`))
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("status = %d, want 400", w.Code)
+	}
+}