Centralized Configuration Management with Hot-Reload and Validation

[indubala0103-hue]

Closes #204

Summary

Implements centralized configuration management with layered sources, JSON Schema validation, hot-reload propagation, versioning with rollback, secret masking, and a management API.

What's included

New modules in src/config/

• versions.ts — ConfigVersionHistory: immutable versioned history of every applied config change (initial load, reload, update, delete, rollback), with retention trimming and monotonic version numbering.
• secrets.ts — Secret masking: values under key paths matching /secret|password|key/i are masked (****) in logs, metrics, and API responses via maskSecrets() / safeConfigForLog().
• metrics.ts — Prometheus counters: config_reload_count, config_validation_errors_total, config_rollbacks_total, plus last-reload-duration gauge.
• etcd_watch.ts — EtcdConfigWatcher: polls the etcd v3 HTTP gateway under /config/{service}/ prefix with a monotonic mod_revision cursor, decodes slash-path keys into nested config, and invokes change callbacks for propagation.
• routes.ts — Management API: GET /config, PUT /config, POST /config/reload, POST /config/rollback/:version, GET /config/versions, GET /config/metrics. All responses secret-masked.

ConfigManager extensions

• Version recorded on initial load, reload, hot update, delete, and rollback.
• rollbackTo(version) — re-validates the historical snapshot against the current schema before reapplying (handles schema evolution); failed rollback leaves running config untouched.
• triggerReloadAsync() — promise-based reload for the API; existing debounced triggerReload() (50ms, under the 100ms propagation target) unchanged.
• Metrics counters incremented on reload success and validation rejection.

Wiring

• index.js registers the management routes after config init.
• src/config/index.ts exports all new modules.

Tests

• New test file tests/config/config_extensions.test.ts covering: version history recording/retention/lookup, rollback with re-validation, failed-rollback safety, secret key detection/masking/log safety, and metrics counters + Prometheus output.
• All existing tests pass (npm test exit code 0) and npm run build is clean.