Settings → Flags lets an admin see every declared flag and set its value per forge, user, role or percentage #1970

Replaces #1828 (pull #1876 red on the MCP protocol test; #1912 red on main's release-record fault).

Done looks like:

• [ ] Settings → Flags (admin only) lists each declared flag with its why, default, owner issue and live values; an admin sets or clears a value. The POST is same-origin checked and validated against the flag's declared type; a non-admin gets a 403.
• [ ] A change takes effect within seconds without a restart.
• [ ] No MCP tool is added or renamed here; if one is, the MCP tests (the forge over MCP > it speaks the protocol) are run and kept green.
• [ ] Tests in a new file named in GATE. Run the settings, board and MCP tests with it.

Start from today's main, at or after 36daece8. The red 'the release record is newest first' on earlier tries was main's own fault (#1837, fixed in 39e98bc9), not the builder's. A new migration is a file src/core/migrations/<UTC yyyymmddHHMMSS>-<name>.ts (see 20261015230000-a-domain-drill.ts), never a number; do not hand-edit src/core/releases.json. Before pushing run bun x tsc --noEmit, the tests this touches, the schema-migrations and schema-additive tests if you add a migration, and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit, and add any new top-level page to the reserved names in the same commit.

Parked by the crew: the check stayed red through 2 automatic tries (pull #1976 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.