PUT /servo-params writes one joint's P/D/I and dead zones within safe ranges, only while nobody drives, and can put the factory values back #450

Part of #439 (tune the servos). This is the write path that the tuning pulls use.

Done:

• [ ] PUT /servo-params {"id": n, "P"?, "D"?, "I"?, "cwDeadZone"?, "ccwDeadZone"?, "minStartupForce"?} validates each value against a documented range and writes it with the Lock dance in src/bus.ts. It answers with the read-back values.
• [ ] It is refused with 409 while anyone holds a turn, a stream is open, or the E-stop is held. It never changes Torque_Limit or the gripper torque cap.
• [ ] POST /servo-params/factory {"id": n} writes back the values recorded at first read, kept in a file next to the settings.
• [ ] Every write appears in the machine log.
• [ ] Owner-only through the relay. Tests against the fake bus cover a write and its read-back, the out-of-range, driving and E-stop refusals, and the factory restore.
• [ ] bun --cwd Software/so101 test passes.