phase: 168_admin_settings_panel

**Phase 168 — Admin Settings panel — final verification: PASS**

1. **Implemented/verified:** `/settings.html` (admin-only) with the 75-field catalogue (`app/core/settings_catalog.py`), DB-over-env overrides in Postgres (`app_settings`, migration 0028 at head, `settings_overlay.py` resolver, `app/api/admin_settings.py` — 4 admin-only routes), live-apply on save with no restart + restart-required badges, Reset/Clear all, write-only secrets, `.env`-never-written, `BOR_SETTINGS_DB=0` kill switch.
2. **Phase E2E: 12/12** — run with `E2E_APP_PORT=8200` (ports 8123/8124 are held by an unrelated "undercooked" project; no process killed, no code change — the documented env override).
3. **Regression set: all 7 suites green in isolation** (theme tab, API tokens, configurable brand, global tuning, admin auth, cache busting, wide desktop column — 38 tests).
4. **Full suite: unit+integration exit 0 (4066 passed), app/ coverage 99%** (gate >90%); **ruff clean, pyright 0 errors / 0 warnings.**
5. **Log contract (rule 10) verified live:** per-turn + per-response byte-budget lines present; settings write lines carry key + action, **never the value**.
6. **Byte-budget audit: all endpoints under the 262,144 B budget**; settings catalogue 23,513 B (gzip 3,326).
7. **Defect fixed (one):** criterion 5 had no integration pin — added `test_bad_row_inserted_directly_never_bricks_boot` to `tests/integration/test_admin_settings_api.py` (malformed row inserted directly → fresh `create_app()` boots, row skipped with logged reason, rest of table applies, `/api/health` 200) — 12/12 green.
8. **Docs pass:** `README.md` and `AGENTS.md` reviewed in full — both consistent with the as-built feature (Settings page table, Settings section, Configuration-reference note, `.env.example` block); **no changes required**.
9. **Cleanup:** audit app killed (by PID); `app_settings` left empty (0 rows); all changes left in the working tree (no commit, per protocol).
10. **Completion criteria:** all 7 checkboxes verified green (criterion 7's commit is the harness's).
11. **Next pending phase:** `170_edit_bubble_sizing`.

frontend/assets/router.js

@@ -82,6 +82,7 @@ const VIEW = {
   "/history.html": "history", // phase 76 task 03: the History view (saved chats)
   "/tokens.html": "tokens", // phase 79 task 06: the Tokens view (access tokens)
   "/theme.html": "theme", // phase 91 task 04: the Theme view (admin palette + branding)
+  "/settings.html": "settings", // phase 168 task 05: the Settings view (admin settings panel)
 };
 
 /* The nav-link href the router stamps active for each view (the
@@ -94,6 +95,7 @@ const VIEW_PATH = {
   history: "/history.html",
   tokens: "/tokens.html",
   theme: "/theme.html", // phase 91 task 04: the Theme view (admin-only)
+  settings: "/settings.html", // phase 168 task 05: the Settings view (admin-only)
 };
 
 /* The lazy view modules — ONLY the non-chat views (chat needs no
@@ -108,6 +110,7 @@ const VIEW_MODULES = {
   history: () => import("./history.js"), // phase 76 task 03
   tokens: () => import("./tokens.js"), // phase 79 task 06
   theme: () => import("./theme.js"), // phase 91 task 04 (wiring) + task 05 (editor)
+  settings: () => import("./settings.js"), // phase 168 task 05 (the settings panel)
 };
 
 /* Per-view document.head values, carried over from the old pages'
@@ -122,6 +125,7 @@ const TITLES = {
   history: "Saved chats · Brain of Reese", // old history.html <title>
   tokens: "Access tokens · Brain of Reese",
   theme: "Theme · Brain of Reese", // phase 91 task 04: no old page — the view is new
+  settings: "Settings · Brain of Reese", // phase 168 task 05: no old page — the view is new
 };
 const DESCRIPTIONS = {
   chat:
@@ -135,6 +139,7 @@ const DESCRIPTIONS = {
     "Saved chats — every conversation is saved automatically, one click back.", // old history.html meta
   tokens: "Generate and revoke the API tokens that let people use the app.",
   theme: "Set the palette and branding — the theme is baked into every served page, live on the first paint.",
+  settings: "Edit any application setting — a saved value wins over the environment, live on save; reset hands control back.",
 };
 
 /* The brand-resolved display name (phase 39 — brand.js is the single