fix(saas): P2 code quality fixes + config PATCH/PUT alignment

P2 code quality (SEC2-P2-01~10):
- P2-04: Replace vague TODO with detailed Phase 2 design note in generate_embedding.rs
- P2-05: Add NOTE(fire-and-forget) annotations to 4 long-running tokio::spawn in main.rs
- P2-07: Add DESIGN NOTE to scheduler explaining sequential execution rationale
- P2-08: Add compile-time table name whitelist + runtime char validation in db.rs
- P2-02: Verified N/A (only zclaw-pipeline uses serde_yaml_bw, no inconsistency)
- P2-06: Verified N/A (bind loop correctly matches 6-column placeholders)
- P2-03: Remains OPEN (requires upstream sqlx release)

Config HTTP method alignment (B3-4):
- Fix admin-v2 config.ts: request.patch -> request.put to match backend .put() route
- Fix backend handler doc comment: PATCH -> PUT
- Add @reserved annotations to 6 config handlers without frontend callers

crates/zclaw-saas/src/migration/handlers.rs

@@ -27,6 +27,7 @@ pub async fn list_config_items(
 }
 
 /// GET /api/v1/config/items/:id
+// @reserved - no frontend caller
 pub async fn get_config_item(
     State(state): State<AppState>,
     Path(id): Path<String>,
@@ -36,6 +37,7 @@ pub async fn get_config_item(
 }
 
 /// POST /api/v1/config/items (admin only)
+// @reserved - no frontend caller
 pub async fn create_config_item(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -47,7 +49,7 @@ pub async fn create_config_item(
     Ok((StatusCode::CREATED, Json(item)))
 }
 
-/// PATCH /api/v1/config/items/:id (admin only)
+/// PUT /api/v1/config/items/:id (admin only)
 pub async fn update_config_item(
     State(state): State<AppState>,
     Path(id): Path<String>,
@@ -61,6 +63,7 @@ pub async fn update_config_item(
 }
 
 /// DELETE /api/v1/config/items/:id (admin only)
+// @reserved - no frontend caller
 pub async fn delete_config_item(
     State(state): State<AppState>,
     Path(id): Path<String>,
@@ -73,6 +76,7 @@ pub async fn delete_config_item(
 }
 
 /// GET /api/v1/config/analysis
+// @reserved - no frontend caller
 pub async fn analyze_config(
     State(state): State<AppState>,
     _ctx: Extension<AuthContext>,
@@ -81,6 +85,7 @@ pub async fn analyze_config(
 }
 
 /// POST /api/v1/config/seed (admin only)
+// @reserved - no frontend caller
 pub async fn seed_config(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,
@@ -132,6 +137,7 @@ pub async fn config_diff(
 }
 
 /// GET /api/v1/config/sync-logs?page=1&page_size=20
+// @reserved - no frontend caller
 pub async fn list_sync_logs(
     State(state): State<AppState>,
     Extension(ctx): Extension<AuthContext>,