Initial

server/routes/settingsRoutes.js

@@ -0,0 +1,9 @@
+import { Router } from 'express';
+import { listSettings, saveSettings } from '../controllers/settingsController.js';
+import { requireAdmin, requireAuth } from '../middleware/auth.js';
+
+export const settingsRoutes = Router();
+
+// Settings are readable by operators but writable only by admins.
+settingsRoutes.get('/', requireAuth, listSettings);
+settingsRoutes.put('/', requireAuth, requireAdmin, saveSettings);