M2-T01: add config JSON API (GET/PUT /api/config)

- new app/api/routes/api/ package with shared require_session (401) and
  require_csrf (presence-only X-CSRF-Token, 403) dependencies
- GET /api/config returns masked config sections; PUT /api/config reuses
  save_config_updates (blank secret keeps old; invalid -> 422, no write)
- session-protected; PUT also CSRF-protected
- register router in app/main.py; regenerate openapi/
- tests/test_api_config.py

app/main.py

@@ -8,6 +8,7 @@ from apscheduler.triggers.interval import IntervalTrigger
 from sqlalchemy.orm import Session
 
 from app import models  # noqa: F401
+from app.api.routes.api.config import router as api_config_router
 from app.api.routes.auth import router as auth_router
 from app.api.routes import pages, status
 from app.db import get_session_local
@@ -91,6 +92,7 @@ def create_app() -> FastAPI:
     app.include_router(status.router)
     app.include_router(auth_router)
     app.include_router(pages.router)
+    app.include_router(api_config_router)
     app.include_router(homeassistant_router)
     app.include_router(location_router)
     app.include_router(poo_router)