[backlog] Global model whitelist resets to empty (upstream #515)

[DeliciousBuding]

    ## Source
    - Upstream: cita-777/metapi #515
    - Matrix: `docs/analysis/original-gap-matrix.md`
    - Category: bug-correctness
    - Status: unknown-needs-runtime · Priority: P0 · Backlog: yes
    - Epic: Admin UX
    - Parent: G3 #10

    ## Evidence (from matrix)
    Settings store `handler/admin/settings.go` + `store/settings.go`; race/reset needs runtime/repro for global model whitelist sporadically resetting to `[]`.

    ## Acceptance criteria (draft — do not implement in G3)
    - [ ] Repro or refute intermittent whitelist reset under concurrent admin/settings updates

• Settings write path is atomic and does not clobber unrelated keys

• Regression tests for concurrent updates of model whitelist

• Operator recovery documented if historical bad state exists

    ## Out of scope for this issue filing
    Docs-only backlog. No product code until a later implementation wave claims this issue.