fix: preserve independent rule changes during queued saves - #26

This PR prevents queued built-in rule saves from overwriting independent changes by applying atomic partial updates.

Changes:

• Added a guarded /api/config/builtin_rules endpoint.
• Updated frontend rule saves to submit deltas.
• Added concurrency, validation, bulk-update, and security regression tests.

Suppressed comments (1)

frontend/src/pages/Settings.tsx:1385

• Because cfg is undefined during the initial config fetch, builtinRules is {} and either button builds an empty payload. The new endpoint explicitly rejects empty objects (panel.py:3617-3619), so clicking All On/All Off before the fetch completes now returns 400 instead of applying the requested bulk action. Build the payload from the complete BUILTIN_RULE_GROUPS list (or disable the buttons until cfg is loaded) so the request is always non-empty and includes every rule.

                  save(() => saveBuiltinRules(next), t('settings.toast.allOn'))
                }}>{t('settings.words.allOn')}</Button>
                <Button size="sm" variant="outline" className="h-6 text-[11px]" onClick={() => {
                  const next = Object.fromEntries(Object.keys(builtinRules).map((r) => [r, false]))
                  save(() => saveBuiltinRules(next), t('settings.toast.allOff'))

• Files reviewed: 4/4 changed files
• Comments generated: 0
• Review effort level: Lite