CHW-1601 AdminSettingsRequired

global runtime settings must be managed from /api/admin/settings; per-org endpoints reject clamav and data_sources fields

Default message: global runtime settings must be managed from /api/admin/settings; per-org endpoints reject clamav and data_sources fields
HTTP status: 403 (client)

Problem. A per-org PATCH /api/settings request tried to mutate the global runtime fields (clamav, data_sources). Cause. Those fields control instance-wide subsystems and are administered through the global /api/admin/settings endpoint, not the per-org settings surface. Fix. Resubmit the global fields against /api/admin/settings (or /api/admin/org-settings?org_id=... for a different org’s runtime overrides) and limit per-org PATCHes to per-org fields. HTTP 403.

Plan-feature gating reuses CHW-1401 PlanFeatureRequired — the configuration plan-features handler references that code directly. See that page for the full description.