Get Tool Settings

Return the effective tool/guardrail settings for the dashboard.

Authentication only on the router: the role decides how much rather than whether, so this is not the deployment-wide gate require_deployment_operator names. A header master key is the deployment credential and reads everything; a session reads everything only while it operates the deployment, and otherwise gets the fields without the service endpoints in them.