feat(settings): add settings management API endpoints

- Add GET /settings/get and POST /settings/set endpoints for managing system settings
- Implement config file persistence for settings changes
- Update config schema to include notification and webhook settings
- Add API documentation for new endpoints
- Move config path variables to global package for consistency

docs/api.md

@@ -1573,6 +1573,134 @@ Log messages are sent as JSON objects:
 
 ---
 
+## Get Settings
+
+**Endpoint:** `/settings/get`  
+**Method:** GET  
+**Auth Required:** Yes (token)  
+**Permission Level:** Superuser, Admin
+
+Get system settings. If no `key` parameter is provided, returns all settings. If `key` is provided, returns only that specific setting.
+
+**Request Headers:**
+```
+X-Token: your_token
+X-Timestamp: 1704067200000
+```
+
+**Query Parameters (optional):**
+```
+key=ListenAddr
+```
+
+| Header | Type | Required | Description |
+|--------|------|----------|-------------|
+| X-Token | string | Yes | Authentication token |
+| X-Timestamp | int64 | Yes | Client timestamp in milliseconds |
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| key | string | No | Specific setting key to retrieve |
+
+**Response (all settings):**
+```json
+{
+  "success": true,
+  "message": "Settings retrieved successfully",
+  "data": {
+    "ListenAddr": "0.0.0.0",
+    "ListenPort": "8080",
+    "FrpcPath": "/usr/bin/frpc",
+    "InstancePath": "./configs",
+    "Debug": true,
+    "Watchdog.Enabled": true,
+    "Watchdog.Port": 12380,
+    "Notification.Enabled": true,
+    "Notification.Method": "webhook",
+    "Webhook.Method": "POST",
+    "Webhook.URL": "https://example.com/webhook",
+    "Webhook.Headers": {
+      "Content-Type": "application/json"
+    },
+    "Webhook.Body": {
+      "text": "Super-frpc notification"
+    }
+  }
+}
+```
+
+**Response (single setting):**
+```json
+{
+  "success": true,
+  "message": "Setting retrieved successfully",
+  "data": {
+    "key": "ListenAddr",
+    "value": "0.0.0.0"
+  }
+}
+```
+
+**Error Response (unknown key):**
+```json
+{
+  "success": false,
+  "message": "Unknown setting key: InvalidKey"
+}
+```
+
+---
+
+## Set Settings
+
+**Endpoint:** `/settings/set`  
+**Method:** POST  
+**Content-Type:** application/json  
+**Auth Required:** Yes (token)  
+**Permission Level:** Superuser, Admin
+
+Update system settings. Multiple settings can be updated in a single request.
+
+**Request Headers:**
+```
+X-Token: your_token
+X-Timestamp: 1704067200000
+```
+
+**Request Body:**
+```json
+{
+  "ListenAddr": "127.0.0.1",
+  "ListenPort": "9090",
+  "Debug": false
+}
+```
+
+| Header | Type | Required | Description |
+|--------|------|----------|-------------|
+| X-Token | string | Yes | Authentication token |
+| X-Timestamp | int64 | Yes | Client timestamp in milliseconds |
+
+**Response:**
+```json
+{
+  "success": true,
+  "message": "Config saved successfully"
+}
+```
+
+**Error Response:**
+```json
+{
+  "success": false,
+  "message": "Failed to save config"
+}
+```
+
+> **Note:** Settings are saved to the config file immediately after update. Unknown keys will be logged as warnings but will not cause the request to fail.
+
+---
+
 ## User Permissions
 
 | Permission | superuser | admin | visitor |
@@ -1584,6 +1712,8 @@ Log messages are sent as JSON objects:
 | Manage users | ✓ | ✗ | ✗ |
 | List active sessions | ✓ | ✓ | ✗ |
 | View logs | ✓ | ✓ | ✓ |
+| Change settings | ✓ | ✓ | ✗ |
+| Get settings | ✓ | ✓ | ✗ |
 
 ---