Get Extension Config

Serve the extension's declarative remote config from the param store.

Deliberately unauthenticated: the payload is public data (a kill switch and CSS selector strings), and the kill switch must reach signed-out and broken-auth clients. Publishing a new app-config param-store version is the operational lever; extensions poll with a 15-minute client cache.