feat(settings): register API config in SettingsService with 2-phase init

CLAUDE.md

@@ -128,8 +128,8 @@ src/synthorg/
   persistence/    # Operational data persistence — pluggable PersistenceBackend protocol, SQLite initial, SettingsRepository (namespaced settings CRUD) (see Memory & Persistence design page)
   observability/  # Structured logging, correlation tracking, log sinks
   providers/      # LLM provider abstraction (LiteLLM adapter)
-  settings/       # Runtime-editable settings persistence (DB > env > YAML > code defaults), typed definitions (8 namespaces), Fernet encryption for sensitive values, config bridge, ConfigResolver (typed composed reads for controllers), validation, registry, change notifications via message bus
-    definitions/  # Per-namespace setting definitions (company, providers, memory, budget, security, coordination, observability, backup)
+  settings/       # Runtime-editable settings persistence (DB > env > YAML > code defaults), typed definitions (9 namespaces), Fernet encryption for sensitive values, config bridge, ConfigResolver (typed composed reads for controllers), validation, registry, change notifications via message bus
+    definitions/  # Per-namespace setting definitions (api, company, providers, memory, budget, security, coordination, observability, backup)
   security/       # SecOps agent, rule engine (soft-allow/hard-deny, fail-closed), audit log, output scanner, output scan response policies (redact/withhold/log-only/autonomy-tiered), risk classifier, risk tier classifier, action type registry, ToolInvoker security integration, progressive trust (4 strategies: disabled/weighted/per-category/milestone), autonomy levels (presets, resolver, change strategy), timeout policies (park/resume)
   templates/      # Pre-built company templates, personality presets, and builder
   tools/          # Tool registry, built-in tools (file_system/, git, sandbox/, code_runner), git clone SSRF prevention (git_url_validator), MCP bridge (mcp/), role-based access, approval tool (request_human_approval)

docs/design/operations.md

@@ -1041,7 +1041,7 @@ and retry guidance.
 - **Budget Panel**: Spending charts, per-agent breakdown (projections/alerts planned)
 - **Meeting Logs**: Placeholder — coming soon
 - **Artifact Browser**: Placeholder — coming soon
-- **Settings**: Runtime-editable configuration via DB-backed settings persistence (8 namespaces: company, providers, memory, budget, security, coordination, observability, backup). 4-layer resolution (DB > env > YAML > code defaults), Fernet encryption for sensitive values, REST API (GET/PUT/DELETE + schema endpoints for dynamic UI generation), change notifications via message bus. `ConfigResolver` provides typed composed reads for API controllers (assembles full Pydantic config models from individually resolved settings, using `asyncio.TaskGroup` for parallel resolution)
+- **Settings**: Runtime-editable configuration via DB-backed settings persistence (9 namespaces: api, company, providers, memory, budget, security, coordination, observability, backup). 4-layer resolution (DB > env > YAML > code defaults), Fernet encryption for sensitive values, REST API (GET/PUT/DELETE + schema endpoints for dynamic UI generation), change notifications via message bus. `ConfigResolver` provides typed composed reads for API controllers (assembles full Pydantic config models from individually resolved settings, using `asyncio.TaskGroup` for parallel resolution)
 
 ### Human Roles
 

src/synthorg/api/app.py

@@ -472,6 +472,27 @@ async def _safe_shutdown(
         )
 
 
+# ── 2-Phase Initialisation ────────────────────────────────────────
+#
+# Phase 1 (construct): Litestar bakes middleware, CORS, and routes
+#   into the app at construction time — these read directly from
+#   RootConfig and are immutable after construction.  Bootstrap-only
+#   settings (server_host, server_port, api_prefix, cors_allowed_origins,
+#   rate_limit_exclude_paths, auth_exclude_paths) are therefore NOT
+#   resolved through SettingsService.
+#
+# Phase 2 (on_startup): After persistence connects and migrations
+#   run, SettingsService + ConfigResolver become available.  Runtime-
+#   editable settings (rate_limit_max_requests, rate_limit_time_unit,
+#   jwt_expiry_minutes, min_password_length) are resolved through
+#   ConfigResolver.get_api_config() by consumers that need current
+#   values post-startup.
+#
+#   Note: Litestar's rate-limit middleware reads max_requests and
+#   time_unit at construction; runtime DB changes are visible only
+#   to code calling get_api_config(), not to the middleware itself.
+
+
 def create_app(  # noqa: PLR0913
     *,
     config: RootConfig | None = None,

src/synthorg/settings/definitions/__init__.py

@@ -5,6 +5,7 @@
 """
 
 from synthorg.settings.definitions import (
+    api,
     backup,
     budget,
     company,
@@ -16,6 +17,7 @@
 )
 
 __all__ = [
+    "api",
     "backup",
     "budget",
     "company",

src/synthorg/settings/definitions/api.py

@@ -0,0 +1,159 @@
+"""API namespace setting definitions.
+
+Registers 10 settings covering server, CORS, rate limiting, and
+authentication.  Four are runtime-editable; six are bootstrap-only
+(``restart_required=True``) because Litestar bakes middleware and
+CORS into the application at construction time.
+"""
+
+from synthorg.settings.enums import SettingLevel, SettingNamespace, SettingType
+from synthorg.settings.models import SettingDefinition
+from synthorg.settings.registry import get_registry
+
+_r = get_registry()
+
+# ── Server (bootstrap-only) ──────────────────────────────────────
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="server_host",
+        type=SettingType.STRING,
+        default="127.0.0.1",
+        description="Server bind address",
+        group="Server",
+        restart_required=True,
+        yaml_path="api.server.host",
+    )
+)
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="server_port",
+        type=SettingType.INTEGER,
+        default="8000",
+        description="Server bind port",
+        group="Server",
+        restart_required=True,
+        min_value=1,
+        max_value=65535,
+        yaml_path="api.server.port",
+    )
+)
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="api_prefix",
+        type=SettingType.STRING,
+        default="/api/v1",
+        description="URL prefix for all API routes",
+        group="Server",
+        level=SettingLevel.ADVANCED,
+        restart_required=True,
+        yaml_path="api.api_prefix",
+    )
+)
+
+# ── CORS (bootstrap-only) ────────────────────────────────────────
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="cors_allowed_origins",
+        type=SettingType.JSON,
+        default='["http://localhost:5173"]',
+        description="Origins permitted to make cross-origin requests",
+        group="CORS",
+        restart_required=True,
+        yaml_path="api.cors.allowed_origins",
+    )
+)
+
+# ── Rate Limiting (exclude_paths: bootstrap-only) ────────────────
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="rate_limit_max_requests",
+        type=SettingType.INTEGER,
+        default="100",
+        description="Maximum requests per time window",
+        group="Rate Limiting",
+        min_value=1,
+        max_value=10000,
+        yaml_path="api.rate_limit.max_requests",
+    )
+)
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="rate_limit_time_unit",
+        type=SettingType.ENUM,
+        default="minute",
+        description="Rate limit time window",
+        group="Rate Limiting",
+        enum_values=("second", "minute", "hour", "day"),
+        yaml_path="api.rate_limit.time_unit",
+    )
+)
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="rate_limit_exclude_paths",
+        type=SettingType.JSON,
+        default='["/api/v1/health"]',
+        description="Paths excluded from rate limiting",
+        group="Rate Limiting",
+        level=SettingLevel.ADVANCED,
+        restart_required=True,
+        yaml_path="api.rate_limit.exclude_paths",
+    )
+)
+
+# ── Authentication (exclude_paths: bootstrap-only) ───────────────
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="jwt_expiry_minutes",
+        type=SettingType.INTEGER,
+        default="1440",
+        description="JWT token lifetime in minutes",
+        group="Authentication",
+        min_value=1,
+        max_value=10080,
+        yaml_path="api.auth.jwt_expiry_minutes",
+    )
+)
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="min_password_length",
+        type=SettingType.INTEGER,
+        default="12",
+        description="Minimum password length for setup and password change",
+        group="Authentication",
+        min_value=12,
+        max_value=128,
+        yaml_path="api.auth.min_password_length",
+    )
+)
+
+_r.register(
+    SettingDefinition(
+        namespace=SettingNamespace.API,
+        key="auth_exclude_paths",
+        type=SettingType.JSON,
+        default="[]",
+        description="Paths excluded from authentication middleware",
+        group="Authentication",
+        level=SettingLevel.ADVANCED,
+        restart_required=True,
+        yaml_path="api.auth.exclude_paths",
+    )
+)

src/synthorg/settings/enums.py

@@ -10,6 +10,7 @@ class SettingNamespace(StrEnum):
     can be edited at runtime via the settings API.
     """
 
+    API = "api"
     COMPANY = "company"
     PROVIDERS = "providers"
     MEMORY = "memory"

src/synthorg/settings/resolver.py

@@ -20,6 +20,7 @@
 from synthorg.settings.errors import SettingNotFoundError
 
 if TYPE_CHECKING:
+    from synthorg.api.config import ApiConfig
     from synthorg.budget.config import BudgetAlertConfig, BudgetConfig
     from synthorg.config.schema import RootConfig
     from synthorg.core.enums import AutonomyLevel
@@ -328,6 +329,71 @@ async def get_budget_config(self) -> BudgetConfig:
             },
         )
 
+    async def get_api_config(self) -> ApiConfig:
+        """Assemble an ``ApiConfig`` with runtime-editable overrides.
+
+        Resolves the four runtime-editable API settings (rate-limit
+        max requests, rate-limit time unit, JWT expiry, min password
+        length) and merges them onto the YAML-loaded base config.
+
+        Bootstrap-only settings (``server_host``, ``server_port``,
+        ``api_prefix``, ``cors_allowed_origins``,
+        ``rate_limit_exclude_paths``, ``auth_exclude_paths``) are
+        **not** resolved — they are baked into the Litestar app at
+        construction and require a restart to take effect.
+
+        Uses ``asyncio.TaskGroup`` to resolve all settings in parallel.
+
+        Returns:
+            An ``ApiConfig`` with DB/env overrides applied to the
+            runtime-editable fields.
+
+        Raises:
+            SettingNotFoundError: If a required API setting is
+                missing from the registry.
+            ValueError: If a resolved value cannot be parsed.
+        """
+        from synthorg.api.config import RateLimitTimeUnit  # noqa: PLC0415
+
+        base = self._config.api
+
+        try:
+            async with asyncio.TaskGroup() as tg:
+                t_max_req = tg.create_task(
+                    self.get_int("api", "rate_limit_max_requests")
+                )
+                t_time_unit = tg.create_task(
+                    self.get_enum("api", "rate_limit_time_unit", RateLimitTimeUnit)
+                )
+                t_jwt_exp = tg.create_task(self.get_int("api", "jwt_expiry_minutes"))
+                t_min_pw = tg.create_task(self.get_int("api", "min_password_length"))
+        except ExceptionGroup as eg:
+            logger.warning(
+                SETTINGS_FETCH_FAILED,
+                namespace="api",
+                key="_composed",
+                error_count=len(eg.exceptions),
+                exc_info=True,
+            )
+            raise eg.exceptions[0] from eg
+
+        return base.model_copy(
+            update={
+                "rate_limit": base.rate_limit.model_copy(
+                    update={
+                        "max_requests": t_max_req.result(),
+                        "time_unit": t_time_unit.result(),
+                    },
+                ),
+                "auth": base.auth.model_copy(
+                    update={
+                        "jwt_expiry_minutes": t_jwt_exp.result(),
+                        "min_password_length": t_min_pw.result(),
+                    },
+                ),
+            },
+        )
+
     async def get_coordination_config(
         self,
         *,