Security: refuse a non-object settings block on save and on read

[SandObserver]

Summary

• Return 400 from POST /api/config when settings is present and is not a plain object. An array or primitive previously lost the preserved settings.auth on write, which removed the password without the current-password check.
• Treat a settings value in apps.json that is not a plain object (array, primitive, null) as wrong shape: back the file up, mark it damaged, refuse sign-in and saving.
• Skip items entries that are not objects on read, after writing a .corrupt- backup of the file. Readers no longer return 500 on a null entry.

Testing
All green. Added 6 tests covering the save route and wrong-typed settings and items on disk; all fail without the change.

Changelog

Security

• Refuse a config save whose settings block is not an object, which could remove the password.

Fixed

• Treat a damaged settings block in the config file as damage instead of loading it as an open install.
• Skip invalid entries in the config file's app list instead of failing health checks, badges and widgets.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.