Get Public System Config

Return ONLY the whitelisted public flags from system_config.

Used by the dashboard to decide which beta features to render entry points for. Any authenticated user can read this; the contract is that only safe-to-expose flags appear in the _PUBLIC_SYSTEM_CONFIG_KEYS whitelist.

If a whitelisted key isn't set in system_config we return it as false rather than omit it — that way the frontend can branch on cfg.foo === true without a separate "is the key set?" check.