Refactor the settings code to allow incremental updates and protected keys. The old settings code was horrendous, even server-side. For example, this is how setting updates from the API were applied to the current instance:
It should be clear that a refactor was very much needed!
/api/v1/settings
endpoint now upsert only the keys contained in the request. Previously it would generate a new GlobalSettings instance and populate the partial settings, leaving the rest at their defaultsTo be filled in by the reviewers