Feat settings cascade (#3)

Co-authored-by: Jeffrey Smith <jasafpro@gmail.com>
Co-committed-by: Jeffrey Smith <jasafpro@gmail.com>

server/handlers/extensions.go

@@ -7,6 +7,8 @@ import (
 
 	"github.com/gin-gonic/gin"
 
+	"strings"
+
 	"switchboard-core/database"
 	"switchboard-core/models"
 	"switchboard-core/store"
@@ -91,7 +93,27 @@ func (h *ExtensionHandler) UpdateUserExtensionSettings(c *gin.Context) {
 
 	settings := json.RawMessage("{}")
 	if body.Settings != nil {
-		settings = body.Settings
+		// v0.2.0: enforce user_overridable — strip locked keys before saving
+		schema := store.ParseSettingsSchema(pkg.Manifest)
+		if len(schema) > 0 {
+			var incoming map[string]any
+			if json.Unmarshal(body.Settings, &incoming) == nil && len(incoming) > 0 {
+				filtered, rejected := store.FilterOverridableKeys(incoming, schema)
+				if len(filtered) == 0 && len(rejected) > 0 {
+					c.JSON(400, gin.H{"error": "these settings cannot be overridden: " + strings.Join(rejected, ", ")})
+					return
+				}
+				if b, err := json.Marshal(filtered); err == nil {
+					settings = json.RawMessage(b)
+				} else {
+					settings = body.Settings
+				}
+			} else {
+				settings = body.Settings
+			}
+		} else {
+			settings = body.Settings
+		}
 	}
 
 	pus := &store.PackageUserSettings{