feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update)

[jopemachine]

Summary

Adds the AppConfig REST v2 API (BA-6556, BEP-1052 / epic BA-5781), mirroring the layered app_config_allow_list / app_config_definition stacks. This is the API surface over the fragment write/search service (BA-6554) and the merged-AppConfig read service (BA-6555).

Endpoints

METHOD	path	auth	operation
POST	/v2/app-config-fragments/	superadmin	create a fragment at any scope
GET	/v2/app-config-fragments/{fragment_id}	superadmin	get by id
PATCH	/v2/app-config-fragments/{fragment_id}	superadmin	update the config document
DELETE	/v2/app-config-fragments/{fragment_id}	superadmin	purge by id
POST	/v2/app-config-fragments/search	superadmin	paginated cross-scope search
POST	/v2/app-config-fragments/scoped-search	auth	fragments visible to the calling (domain, user)
POST	/v2/app-config/resolve	auth	merged AppConfig for a principal
GET	/v2/app-config/public/{config_name}	anonymous	public-only merged read (no auth middleware)

Layers

• DI wiring — register AppConfigFragmentRepositories + AppConfigService / AppConfigFragmentService + processors into Repositories / Services / Processors / factory.
• scoped_search — now principal-visibility aware: VisibleConfigTarget + AppConfigVisibleScope resolve to public + the principal's domain + the principal's own user fragment (reusing the by_*_visibility conditions), unconditional like resolve.
• public resolve — AppConfigService.resolve_public + list_public_fragments merge only public-scope fragments for an anonymous (pre-login) caller.
• API — shared AppConfigAdapter, v2 DTOs (app_config, app_config_fragment), route registries + tree wiring, AppConfigResolveNotAllowed (403).

Notes

• app_config processors carry no RBAC validator (per the agreed phase plan) — auth is gated at the REST route. resolve / scoped-search additionally reject a request whose user_id is not the authenticated caller, a temporary stand-in until the validator lands. domain is not yet guarded.
• GQL / SDK / CLI for AppConfig follow in subsequent PRs.

📚 Stacked PRs

Part of the AppConfigFragment / AppConfig stack under BEP-1052 (epic BA-5781). Merge in order:

1. ✅ feat(BA-6552): add app_config_fragments DB model and Alembic migration #12306 — feat(BA-6552): app_config_fragments DB model and Alembic migration
2. ✅ feat(BA-6553): add app_config_fragments repository layer #12307 — feat(BA-6553): repository layer
3. ✅ refactor(BA-6619): consolidate AppConfigScopeType into common.data (single definition) #12403 — refactor(BA-6619): consolidate AppConfigScopeType into common.data
4. ✅ refactor(BA-6620): ExistsQuerier ops primitive + AppConfigAllowList.exists #12405 — refactor(BA-6620): ExistsQuerier + AppConfigAllowList.exists
5. ✅ feat(BA-6554): add app_config_fragment service layer #12358 — feat(BA-6554): AppConfigFragment service layer
6. feat(BA-6628): conditional-bulk repository primitives #12429 — feat(BA-6628): conditional-bulk repository primitives
7. feat(BA-6626): app_config_fragment bulk repository layer #12426 — feat(BA-6626): app_config_fragment bulk repository layer
8. feat(BA-6618): app_config_fragment bulk CRUD service layer #12401 — feat(BA-6618): AppConfigFragment bulk CRUD service layer
9. feat(BA-6555): add app_config service layer #12359 — feat(BA-6555): app_config service layer
10. 👉 feat(BA-6556): AppConfig REST v2 API (raw fragments and merged read/update) #12377 — feat(BA-6556): AppConfig REST v2 API ← you are here