[jmfederico]

What and why

Make deployment defaults, saved settings, project overrides, and enforced environment values follow one documented configuration model. Users can reset saved overrides without copying or losing deployment defaults. Server plugins receive resolved settings from PI WEB rather than implementing their own configuration readers.

Settings shows configuration sources and enforcement, preserves browser choices hidden by policy, and resolves declared settings containers field by field while replacing individual array/dictionary values as a whole.

Deployment compatibility needs attention: boolean policy inputs now require explicit true/false or 1/0 values, misspelled known container fields fail visibly, and the updated Settings UI requires PATCH-capable servers. Config saves require a writable containing directory. Daemon-loaded changes require a manual restart, which interrupts active sessions and terminals.

This merges the implementation for use and observation before publication; it does not publish a release.

Technical details and verification

• Added optional read-only deployment defaults selected by PI_WEB_DEFAULTS_CONFIG, core environment overrides, source/enforcement metadata, sparse updates, and deletion-based resets.
• Kept explicit path additions, plugin/localization namespaces, Pi-owned configuration boundaries, and plugin-owned domain files. No schema framework or automatic plugin form generator.
• Protected hidden enforced values during legacy PUT saves; bounded dialog timeouts; clarified machine base roots versus global/project additions.
• Documented the configuration architecture, extension checklist, plugin settings delivery contract, and migration considerations. Included release fragments for later publication.

Local verification before integrating current main:

• Full test suite: 8,239 passed, 22 skipped.
• Cached typecheck, scoped ESLint, Knip, documentation checks, and whitespace checks passed.
• Isolated Chromium checks covered enforcement, preserved browser preferences, resets, path summaries, and desktop/mobile overflow.

After integrating current main, the affected AppContextBar tests (14), scoped lint, cached typecheck, and whitespace checks passed. GitHub CI must pass before merging. No hosting session-daemon restart was performed.

Automatically generated by the user's AI workflow.