feat: add seller settings

docs/API.md

@@ -102,6 +102,8 @@ GET    /api/v1/admin/dashboard
 GET    /api/v1/admin/exports/inventory.json
 GET    /api/v1/admin/exports/inventory.csv
 GET    /api/v1/admin/exports/inventory.xls
+GET    /api/v1/admin/settings
+PATCH  /api/v1/admin/settings
 
 GET    /api/v1/admin/saved-views
 POST   /api/v1/admin/saved-views

docs/DATA-MODEL.md

@@ -109,6 +109,13 @@ As described above.
 - active
 - sort
 
+## Seller Settings
+
+`seller_settings` stores one JSON settings document per Seller. Supported
+categories are general contact details, inventory image limits, pricing
+strategy, and session idle duration. Settings are private to the Seller and
+are validated through the admin API allowlist.
+
 `conditions`:
 - id
 - condition_profile_id

docs/IMPLEMENTATION-STATUS.md

@@ -126,7 +126,7 @@ Verified locally: `npm test` passes 116 tests with no failures; worker tests, we
 Complete production configuration and operational maturity around the implemented vertical slices.
 
 1. Configure and validate an approved external pricing provider and provider-specific mapping data.
-2. Add richer exports/settings, broader accessibility/manual coverage, and any remaining integration edge cases.
+2. Add asynchronous large exports, broader accessibility/manual coverage, and any remaining integration edge cases.
 
 Acceptance criteria: production provider credentials are secret-managed, migrations and backups are exercised in the target environment, and CI runs integration, authenticated E2E, web, build, Storybook build, and Storybook interaction/accessibility gates.
 
@@ -136,7 +136,7 @@ Work through one bounded vertical slice at a time. The linked documentation rema
 
 Completed vertical slices include authentication, listings and image prerequisites, acquisitions, sales and audited corrections, dashboard metrics/alerts, pricing observations and quality handling, provider mappings, durable pricing refresh jobs, public search/detail/image states, admin workflows, CI integration/E2E gates, production Docker packaging, rollback/health checks, PostgreSQL backup verification, restore drill scripts, image-storage restore support, and deployment smoke checks.
 
-Remaining roadmap areas are bulk status/tag/pricing actions, richer exports/settings, approved external provider credentials/adapters, broader accessibility/manual coverage, and deployment-specific NAS/TLS validation.
+Remaining roadmap areas are bulk status actions, asynchronous large exports, approved external provider credentials/adapters, broader accessibility/manual coverage, and deployment-specific NAS/TLS validation.
 
 ## Known Gaps
 
@@ -152,6 +152,7 @@ Remaining roadmap areas are bulk status/tag/pricing actions, richer exports/sett
 - Admin inventory JSON export is implemented at `GET /api/v1/admin/exports/inventory.json` and serializes seller-scoped admin DTOs as a downloadable attachment.
 - Admin inventory CSV export is implemented at `GET /api/v1/admin/exports/inventory.csv` with escaped spreadsheet-safe fields and seller-scoped admin DTOs.
 - Admin inventory Excel-compatible export is implemented at `GET /api/v1/admin/exports/inventory.xls` using the XML workbook format and seller-scoped admin DTOs.
+- Seller-scoped admin settings are implemented through `GET/PATCH /api/v1/admin/settings` with strict category allowlists and server-side partial-update merging.
 - PostgreSQL restore verification and image snapshot restore scripts are implemented and covered by shell tests as part of the deployment drill workflow.
 - `npm audit --omit=dev` currently reports zero production vulnerabilities. Re-run the audit after dependency changes and review development-dependency findings separately before production releases.