Validate settings files with published JSON Schemas #506

Follow-up from the PR #500 review discussion.

Replace most of the hand-written per-field validation in internal/settings with JSON Schema:

• Publish a schema per settings file (roles.json, policies.json, pipes.json, config.json) so editors flag problems via $schema before the binary ever runs
• Validate against the same schemas in Go, mapping schema error paths onto settings.Finding
• Hand-written checks shrink to what schemas cannot express: cross-file role references and the warning tier