V0.38.3 extension config sections (#236)

Co-authored-by: gobha <jasafpro@gmail.com>
Co-committed-by: gobha <jasafpro@gmail.com>

docs/ICD/extensions.md

@@ -458,6 +458,58 @@ returns them as a frozen struct. Results are cached per invocation.
 
 ---
 
+### Config Sections (v0.38.3)
+
+Packages can declare a `config_section` in their manifest to inject a
+Preact configuration component into the Settings, Admin, or Team Admin
+surfaces. This enables headless extensions and libraries to own their
+configuration UX without requiring a full surface.
+
+**Manifest schema:**
+
+```json
+{
+  "config_section": {
+    "label": "My Extension",
+    "icon": "M12 2L2 7...",
+    "component": "js/config.js",
+    "surfaces": ["admin", "settings", "team-admin"],
+    "category": "system"
+  }
+}
+```
+
+| Field | Type | Required | Description |
+|-------|------|----------|-------------|
+| `label` | string | Yes | Nav link text. Falls back to package title if empty. |
+| `icon` | string | No | SVG path data in compact format (admin CatIcon). |
+| `component` | string | No | Relative path within the package archive. Default: `js/config.js`. |
+| `surfaces` | string[] | Yes | Target surfaces: `admin`, `settings`, `team-admin`. |
+| `category` | string | No | Admin-only: category tab to appear under. Default: `system`. |
+
+**Component contract:**
+
+The config section component is a standard ES module exporting a
+default Preact component. It is lazy-loaded via dynamic `import()` from
+the existing asset-serving endpoint (`GET /surfaces/:id/:component`).
+
+The component uses `sw.sdk` to read/write its own package settings:
+- `sw.api.admin.packages.settings(packageId)` — read
+- `sw.api.admin.packages.updateSettings(packageId, data)` — write
+
+Settings are stored in the `package_settings` JSONB column (admin scope)
+and `package_user_settings` table (user scope).
+
+**Discovery:** At page load, the backend queries enabled packages for
+`config_section` entries targeting the current surface and passes them
+as `__CONFIG_SECTIONS__` to the frontend. The surface merges them into
+its nav and section module map.
+
+**No new tables or endpoints.** Config sections are purely manifest-driven,
+using existing package storage and settings infrastructure.
+
+---
+
 ### Builtin Seeding
 
 On startup, `SeedBuiltinExtensions()` scans `extensions/builtin/`