Restrict global system settings to platform admins

[yaojin3616]

Summary

• restrict global system-setting reads and writes to platform administrators
• retain the dedicated public notification-bar endpoint as the only unauthenticated settings read
• add regression coverage for member and organization-admin denial cases

Root cause

The generic system-settings read route required only authentication, while the write route accepted organization administrators. Both routes provide access to platform-wide values, including SMTP and Jina credentials.

Validation

• PYTHONPATH=. uv run pytest tests/test_system_settings_api.py
• PYTHONPATH=. uv run ruff check tests/test_system_settings_api.py

Closes #152