Initial commit: UOMysticmoon backend (Express + MariaDB + JWT)

- Layered API (router -> controller -> model -> db), serverlinkr pattern
- Public / auth / admin route groups; posts, wiki, settings, users, activity models
- JWT httpOnly-cookie auth (Secure auto-detected: LAN HTTP + Pangolin HTTPS)
- Site LIVE/MAINTENANCE mode with admin preview bypass
- Dual file+console logging (info/warn/error/debug) + HTTP access logs
- Docker Compose (app + MariaDB), schema.sql + seed, .env.example
- Verified end-to-end against MariaDB (27/27 smoke checks)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/src/model/settings/settings.model.js

@@ -0,0 +1,43 @@
+const settingsDb = require('./settings.db')
+
+// Keys safe to expose on the public site.
+const PUBLIC_KEYS = [
+  'site_mode',
+  'maintenance_message',
+  'status_message',
+  'homepage_teaser',
+  'contact_email',
+  'site_title',
+]
+
+async function get(key) {
+  return settingsDb.get(key)
+}
+
+async function set(key, value, updatedBy = null) {
+  return settingsDb.set(key, value, updatedBy)
+}
+
+async function setMany(obj, updatedBy = null) {
+  for (const [key, value] of Object.entries(obj)) {
+    await settingsDb.set(key, value, updatedBy)
+  }
+}
+
+async function getAll() {
+  const rows = await settingsDb.getAll()
+  return rows.reduce((acc, row) => {
+    acc[row.key] = row.value
+    return acc
+  }, {})
+}
+
+async function getPublic() {
+  const all = await getAll()
+  return PUBLIC_KEYS.reduce((acc, key) => {
+    if (all[key] !== undefined) acc[key] = all[key]
+    return acc
+  }, {})
+}
+
+module.exports = { get, set, setMany, getAll, getPublic, PUBLIC_KEYS }