feat(webui): expose scoped settings and validated load profiles

[inureyes]

Parent / dependencies

Parent: #1834. Depends on #1835, #1839, #1840, #1842, #1843, #1838, #1837.

Ownership

Own webui/src/features/settings/, request/load-profile form components and the narrow next-load profile validator/adapter in src/server/webui/. Reuse runtime_settings.rs, existing startup/preset resolution and actual server schema. Central startup/config changes are coordinated with their owner.

Required behavior

• Separate Appearance/Privacy (browser only), Generation (per request), Loaded model (live server values), Next load (profile) and Server startup (read-only restart flags). Labels state scope and timing; show current versus pending values. UI does not silently enable --settings, --props, --metrics or slots when the operator disabled them.
• Render live controls from /settings schema/current/fingerprint: type/range/allowed values/mutable/reason. PATCH is partial success; reflect applied fields, preserve rejected input with its field error, then refetch effective values. Detect stale external edits by fingerprint and require refresh/reconfirmation; do not claim an atomic compare-and-swap unless the server actually enforces one. Reset is scoped and confirmed.
• Generation basics: max output, temperature, top-p/top-k, seed and system prompt, with advanced repetition/reasoning/structured-output options only if the selected endpoint/model supports them. Unset means omit and inherit, not send null or zero. Validate context budget from actual /props and tokenization when available; an estimate never replaces server validation.
• Implement an explicit next-load profile attached to the operation, NOT hot mutation: initial allowed keys ctx_size, n_parallel, and kv_cache_mode (serialized from the existing KVCacheMode choices, not a new quantizer) only when existing CLI/startup validators and selected model/backend support them. Reuse conversion, accepted enum names and range logic; expose effective resolved values including CLI/preset overrides. No raw argv, shell text, model path, token, network or distributed fields. Loaded model requires explicit unload/reload to apply.
• Profiles persist only in browser preferences (no secrets); carry schema version, validate import, identify model-specific versus reusable values, and show a sanitized reproducible CLI command without executing it. Single-model mode offers restart instructions, not fake next-load Apply. Keep draft/adapters/distributed/worker-geometry fields read-only in v1 unless added through a reviewed contract change.

Acceptance criteria

• Test disabled settings endpoint, schema read-only reason, invalid range/enum, mixed applied/rejected PATCH, another client changing values, reset and unsupported model knob. No successful toast for rejected fields.
• Test precedence startup CLI/preset/profile and omission semantics, plus profile version migration and rejected unsafe keys; API and UI share validators/fixtures.
• Real checkpoint reload with a supported context profile reports the actual changed /props; no hot worker-setting mutation occurs. Pending changes survive a failed load without being represented as active.
• Context displays honor actual per-slot/shared-pool facts, handle n_ctx=0/unknown safely and reference fix(server): give every slot the whole context under auto --parallel #1815 as external work rather than implementing unified KV here.