Update Settings Batch

Update multiple settings at once.

PR3 audit fix: enforces the same _is_admin_writable whitelist as update_setting so the batch path can't write to system-only keys (e.g. JWT_SECRET if it ever lands in app_settings). Each row also writes to admin_audit_log so the forensic trail is identical to the single-update path.