decoupled_settings 1.0.0-beta1

First release. Decoupled Settings exposes allowlisted simple config over JSON:API, with global values read in place and sparse per-consumer overrides on the Consumers entity.

• A read-only JSON:API resource at /jsonapi/decoupled/settings, built on JSON:API Resources. Responses carry the config cache tags of every object read and cache contexts for both consumer negotiation mechanisms, and a page-cache request policy keeps header-identified requests out of the internal page cache.
• Global values are read from the config objects that already hold them. There is no second copy of the site name to drift or sync.
• A consumer stores only the settings it overrides; everything else inherits per key. An override set to an empty value stays empty, and clearing it restores inheritance.
• Exposure is bounded twice: an administrator lists the exposed config objects, and typed config schema decides which keys appear. Ignore-typed and undeclared keys never appear, and an exclusion list removes the rest, with the site email address excluded by default.
• Theme settings come through core's own resolution, so logo and favicon are resolved URLs with core's fallbacks.
• An exposure form with a live review of what a frontend will read, including unsaved changes, and a per-consumer overrides form with typed widgets that keep each value's type. The consumer list counts each consumer's overrides.
• hook_decoupled_settings_global_alter() lets a module contribute computed settings, per-consumer overridable like everything else.
• Simple OAuth needs no extra setup: an authenticated app is identified by its token alone.

Known limitations: exposing a value to authenticated apps while hiding it from anonymous readers is not expressible yet (per-consumer include/exclude is planned), and translation of exposed values is not handled.