Settings UI for admin-configurable rate limits #37

Context

Issue #25 adds admin-configurable rate limiting (token bucket, per-user for chat, per-IP for auth) with full backend support: GET/PUT /api/settings expose and accept 5 new fields (rate_limit_enabled, rate_limit_chat_capacity, rate_limit_chat_refill_per_minute, rate_limit_auth_capacity, rate_limit_auth_refill_per_minute), each following the standard env-default + nullable-DB-override + audit-log pattern already used for retention/guardrails/tracing.

frontend/src/components/Settings.tsx hand-renders each settings field explicitly — there is no auto-rendering from SystemSettingsResponse. The 5 new fields are therefore reachable via the API (and docs/SECURITY.md documents them), but not yet editable from the Settings screen.

Scope

Add UI controls to Settings.tsx (and frontend/src/types/settings.ts's response typing) for the 5 rate-limit fields, following the existing pattern used for the guardrail/tracing fields already surfaced there (value + "is DB override" indicator + clear-to-default control).

Standards

Per AGENTS.md, since this is a user-facing change: add/extend a Vitest component test for the new controls, and add or extend an e2e spec once the UI exists (real login, real backend) — see AGENTS.md's "End-to-End (E2E) Tests" section.

Done when

An admin can view and edit all 5 rate-limit fields from the Settings screen, with the same DB-override/clear-to-default affordances as the existing fields, backed by a component test and (if behavior is meaningfully user-visible) an e2e spec.