feat: persistent per-application config with GET/PUT endpoints

Add application_config table (V4 migration), repository, and REST
controller. GET /api/v1/config/{app} returns config, PUT saves and
pushes CONFIG_UPDATE to all LIVE agents via SSE. UI tracing toggle
now uses config API instead of direct SET_TRACED_PROCESSORS command.
Tracing store syncs with server config on load.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/java/com/cameleer3/server/app/controller/ApplicationConfigController.java

@@ -0,0 +1,104 @@
+package com.cameleer3.server.app.controller;
+
+import com.cameleer3.common.model.ApplicationConfig;
+import com.cameleer3.server.app.storage.PostgresApplicationConfigRepository;
+import com.cameleer3.server.core.agent.AgentCommand;
+import com.cameleer3.server.core.agent.AgentInfo;
+import com.cameleer3.server.core.agent.AgentRegistryService;
+import com.cameleer3.server.core.agent.AgentState;
+import com.cameleer3.server.core.agent.CommandType;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import io.swagger.v3.oas.annotations.Operation;
+import io.swagger.v3.oas.annotations.responses.ApiResponse;
+import io.swagger.v3.oas.annotations.tags.Tag;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.ResponseEntity;
+import org.springframework.security.core.Authentication;
+import org.springframework.web.bind.annotation.*;
+
+import java.util.List;
+import java.util.Map;
+
+/**
+ * Per-application configuration management.
+ * Agents fetch config at startup; the UI modifies config which is persisted and pushed to agents via SSE.
+ */
+@RestController
+@RequestMapping("/api/v1/config")
+@Tag(name = "Application Config", description = "Per-application observability configuration")
+public class ApplicationConfigController {
+
+    private static final Logger log = LoggerFactory.getLogger(ApplicationConfigController.class);
+
+    private final PostgresApplicationConfigRepository configRepository;
+    private final AgentRegistryService registryService;
+    private final ObjectMapper objectMapper;
+
+    public ApplicationConfigController(PostgresApplicationConfigRepository configRepository,
+                                       AgentRegistryService registryService,
+                                       ObjectMapper objectMapper) {
+        this.configRepository = configRepository;
+        this.registryService = registryService;
+        this.objectMapper = objectMapper;
+    }
+
+    @GetMapping("/{application}")
+    @Operation(summary = "Get application config",
+            description = "Returns the current configuration for an application. Returns defaults if none stored.")
+    @ApiResponse(responseCode = "200", description = "Config returned")
+    public ResponseEntity<ApplicationConfig> getConfig(@PathVariable String application) {
+        return ResponseEntity.ok(
+                configRepository.findByApplication(application)
+                        .orElse(defaultConfig(application)));
+    }
+
+    @PutMapping("/{application}")
+    @Operation(summary = "Update application config",
+            description = "Saves config and pushes CONFIG_UPDATE to all LIVE agents of this application")
+    @ApiResponse(responseCode = "200", description = "Config saved and pushed")
+    public ResponseEntity<ApplicationConfig> updateConfig(@PathVariable String application,
+                                                           @RequestBody ApplicationConfig config,
+                                                           Authentication auth) {
+        String updatedBy = auth != null ? auth.getName() : "system";
+
+        config.setApplication(application);
+        ApplicationConfig saved = configRepository.save(application, config, updatedBy);
+
+        int pushed = pushConfigToAgents(application, saved);
+        log.info("Config v{} saved for '{}', pushed to {} agent(s)", saved.getVersion(), application, pushed);
+
+        return ResponseEntity.ok(saved);
+    }
+
+    private int pushConfigToAgents(String application, ApplicationConfig config) {
+        String payloadJson;
+        try {
+            payloadJson = objectMapper.writeValueAsString(config);
+        } catch (JsonProcessingException e) {
+            log.error("Failed to serialize config for push", e);
+            return 0;
+        }
+
+        List<AgentInfo> agents = registryService.findAll().stream()
+                .filter(a -> a.state() == AgentState.LIVE)
+                .filter(a -> application.equals(a.application()))
+                .toList();
+
+        for (AgentInfo agent : agents) {
+            registryService.addCommand(agent.id(), CommandType.CONFIG_UPDATE, payloadJson);
+        }
+        return agents.size();
+    }
+
+    private static ApplicationConfig defaultConfig(String application) {
+        ApplicationConfig config = new ApplicationConfig();
+        config.setApplication(application);
+        config.setVersion(0);
+        config.setMetricsEnabled(true);
+        config.setSamplingRate(1.0);
+        config.setTracedProcessors(Map.of());
+        return config;
+    }
+}

cameleer3-server-app/src/main/java/com/cameleer3/server/app/security/SecurityConfig.java

@@ -77,6 +77,10 @@ public class SecurityConfig {
                         .requestMatchers(HttpMethod.GET, "/api/v1/search/**").hasAnyRole("VIEWER", "OPERATOR", "ADMIN", "AGENT")
                         .requestMatchers(HttpMethod.POST, "/api/v1/search/**").hasAnyRole("VIEWER", "OPERATOR", "ADMIN")
 
+                        // Application config endpoints
+                        .requestMatchers(HttpMethod.GET, "/api/v1/config/*").hasAnyRole("VIEWER", "OPERATOR", "ADMIN", "AGENT")
+                        .requestMatchers(HttpMethod.PUT, "/api/v1/config/*").hasAnyRole("OPERATOR", "ADMIN")
+
                         // Read-only data endpoints — viewer+
                         .requestMatchers(HttpMethod.GET, "/api/v1/executions/**").hasAnyRole("VIEWER", "OPERATOR", "ADMIN")
                         .requestMatchers(HttpMethod.GET, "/api/v1/diagrams/**").hasAnyRole("VIEWER", "OPERATOR", "ADMIN")

cameleer3-server-app/src/main/java/com/cameleer3/server/app/storage/PostgresApplicationConfigRepository.java

@@ -0,0 +1,59 @@
+package com.cameleer3.server.app.storage;
+
+import com.cameleer3.common.model.ApplicationConfig;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import org.springframework.jdbc.core.JdbcTemplate;
+import org.springframework.stereotype.Repository;
+
+import java.util.List;
+import java.util.Optional;
+
+@Repository
+public class PostgresApplicationConfigRepository {
+
+    private final JdbcTemplate jdbc;
+    private final ObjectMapper objectMapper;
+
+    public PostgresApplicationConfigRepository(JdbcTemplate jdbc, ObjectMapper objectMapper) {
+        this.jdbc = jdbc;
+        this.objectMapper = objectMapper;
+    }
+
+    public Optional<ApplicationConfig> findByApplication(String application) {
+        List<ApplicationConfig> results = jdbc.query(
+                "SELECT config_val FROM application_config WHERE application = ?",
+                (rs, rowNum) -> {
+                    try {
+                        return objectMapper.readValue(rs.getString("config_val"), ApplicationConfig.class);
+                    } catch (JsonProcessingException e) {
+                        throw new RuntimeException("Failed to deserialize application config", e);
+                    }
+                },
+                application);
+        return results.isEmpty() ? Optional.empty() : Optional.of(results.get(0));
+    }
+
+    public ApplicationConfig save(String application, ApplicationConfig config, String updatedBy) {
+        String json;
+        try {
+            json = objectMapper.writeValueAsString(config);
+        } catch (JsonProcessingException e) {
+            throw new RuntimeException("Failed to serialize application config", e);
+        }
+
+        // Upsert: insert or update, auto-increment version
+        int updated = jdbc.update("""
+                INSERT INTO application_config (application, config_val, version, updated_at, updated_by)
+                VALUES (?, ?::jsonb, 1, now(), ?)
+                ON CONFLICT (application) DO UPDATE SET
+                    config_val = EXCLUDED.config_val,
+                    version = application_config.version + 1,
+                    updated_at = now(),
+                    updated_by = EXCLUDED.updated_by
+                """,
+                application, json, updatedBy);
+
+        return findByApplication(application).orElseThrow();
+    }
+}

cameleer3-server-app/src/main/resources/db/migration/V4__application_config.sql

@@ -0,0 +1,9 @@
+-- Per-application configuration for agent observability settings.
+-- Agents download this at startup and receive updates via SSE CONFIG_UPDATE.
+CREATE TABLE application_config (
+    application   TEXT PRIMARY KEY,
+    config_val    JSONB NOT NULL,
+    version       INTEGER NOT NULL DEFAULT 1,
+    updated_at    TIMESTAMPTZ NOT NULL DEFAULT now(),
+    updated_by    TEXT
+);