Extend template sync script to generate frontend allow/deny lists so
ProgramSettingsPage can hide can_edit=1 keys before API purge deploys.
Co-authored-by: Cursor <cursoragent@cursor.com>
Superadmin was seeding all deploy_settings_const INSERT keys including
can_edit=1 entries with wrong defaults (e.g. montzar_product_id=25).
Template/catalog now follow final can_edit=0 from SQL; editable keys are
purged from setting_templates and tenant settings on boot/seed.
Co-authored-by: Cursor <cursoragent@cursor.com>