feat(validator): add settings constraint validation pilot

[somethingwithproof]

Current Status

Consolidated into #7189. Keep this PR only as historical review context for the original Symfony Validator settings pilot; the merge direction should be the DI-friendly component baseline in #7189.

Original Scope

• Piloted Symfony Validator behind Cacti-owned settings validation code.
• Proved the adapter approach before broader Symfony component adoption.

Recommendation

Do not merge this independently unless it is deliberately rebased to match #7189. Validation code should follow the #7189 direction: Cacti-owned injectable wrappers, with static facades only where legacy procedural code still needs them.

[Copilot]

Pull request overview

Adds a Symfony Validator–backed “settings constraints” pilot to centralize and enforce validation for a targeted subset of high-value settings at save time in the Cacti web UI.

Changes:

• Introduces lib/CactiSettings::validate() to run Symfony constraints declared alongside settings definitions.
• Adds constraints declarations to selected entries in include/global_settings.php and validates in settings.php before any DB writes.
• Adds unit tests for validation behavior plus a short migration/how-to doc.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
composer.json	Adds symfony/validator dependency.
lib/CactiSettings.php	New validator wrapper: flattens settings definitions and returns first violation per setting.
include/global_settings.php	Adds Assert constraints to selected settings definitions.
settings.php	Runs validation before persisting settings; surfaces violations via raise_message().
tests/Unit/CactiSettingsTest.php	Pest unit coverage for input shapes and constraint types.
docs/security/settings-validation.md	Documents the new constraints pattern and how to extend it.

[somethingwithproof]

Queue note: this should follow #7125. After #7125 lands, rebase this settings validation pilot onto the shared CactiValidator helper/dependency and remove duplicate composer/baseline churn.

[somethingwithproof]

Addressing all 11 Copilot suggestions:

• Autoload order: global_settings.php already guards with file_exists + require_once vendor/autoload.php before the Assert use statement (lines 29-31). No change needed.
• i18n: All constraint messages already use __() — grep for message: ' shows no unwrapped strings.
• Choice duplication: Already uses array_keys($GLOBALS['poller_intervals']) / array_keys($GLOBALS['cron_intervals']) — no hard-coded list.
• Redundant test require: The require at line 15 in CactiSettingsTest.php is lib/CactiSettings.php (the class under test), not vendor/autoload.php — no change needed. CactiValidatorTest.php has a genuinely redundant require, will fix there.
• Translator for Validator: Noted for future enhancement; constraint messages explicitly pass translated strings via __() so the fallback English messages from Symfony are not reached.
• settings.php $_POST: Will switch to gnrv() map in a follow-up commit.

[somethingwithproof]

Closing as superseded by #7189, which carries this work forward as the DI-friendly component baseline. Leaving the branch in place so the review history stays accessible.