Add /super/settings endpoints and API middleware that returns generic 503 while keeping unlock routes whitelisted. Co-authored-by: Cursor <cursoragent@cursor.com>