feat: settings page accessible to all authenticated users

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NfPpSpccTWBfZg1FTveyaU

hbd/server/http.py

@@ -1126,19 +1126,18 @@ async def start(
         return web.Response(text=body, content_type="text/html")
 
     # -------------------------------------------------------------------------
-    # Settings page (admin only)
+    # Settings page
     # -------------------------------------------------------------------------
 
     async def settings_page(request):
-        """GET /settings — read-only view of the current server configuration."""
+        """GET /settings — server configuration; non-admins see only what they own or manage."""
         current_user, _ = _require_auth_redirect(request)
-        if current_user and not current_user.admin:
-            raise web.HTTPForbidden(reason="Admin access required")
         pkg_dir = os.path.dirname(__file__)
         templates_dir = config.get("templates_dir", os.path.join(pkg_dir, "templates"))
         env = jinja2.Environment(loader=jinja2.FileSystemLoader(templates_dir), autoescape=True)
         tmpl = env.get_template("settings.html")
-        settings_data = settings_mod.get_settings_data(config, threshold_checker=threshold_checker)
+        settings_data = settings_mod.get_settings_data(
+            config, threshold_checker=threshold_checker, user=current_user)
         body = tmpl.render(
             title="Settings - Heartbeat",
             sections=settings_data["sections"],