feat(rc-admin)!: add safe server configuration management

[cxymds]

Related issues

Closes rustfs/backlog#1375

Replaces closed PR #283 after its stacked base was removed. Server-side safety limitations remain tracked in rustfs/backlog#1398 and rustfs/backlog#1399.

Background and user impact

RustFS beta.10 exposes server configuration reads, mutations, history, restore, help, and module-switch routes, but rc lacked a safe workflow around them. Raw server documents may contain credentials, destructive replacements can remove unrelated settings, and the service does not expose revision or ETag tokens for optimistic concurrency.

Solution

• Add rc admin config get|set|delete|help|history|restore|export|import and module-switch support.
• Compute deterministic, redacted dry-run diffs before mutations.
• Require explicit confirmation for restore and import replacement operations.
• Redact current secret fields plus conservative connection, DSN, API, account, and access-key names.
• Preserve unparseable non-secret lines while conservatively truncating malformed sensitive assignments.
• Support KEY=@PATH values with a 1 MiB limit, one-line UTF-8 validation, and Unix regular-file, non-symlink, private-permission checks.
• Keep sensitive values in bounded zeroizing request bodies and discard server error bodies.
• Fetch help once per subsystem; missing or incomplete metadata becomes a warning and the server remains authoritative.
• Base module-switch diffs on persisted state so environment overrides cannot create phantom compliance changes.
• Allow confirmed restore by an older history ID when its preview is outside the latest 1000 entries, while refusing dry-run because a safe diff is unavailable.
• Export with create-new semantics and owner-private permissions without overwriting existing files.

Review follow-up from #283

All requested changes from overtrue are addressed:

• MAJOR — mixed effective/persisted switch planes: fixed; unit and integration coverage include environment overrides.
• Secret values in positional argv: added KEY=@PATH with bounded and permission-checked file input.
• Fragile redaction denylist: expanded conservative classification for connection strings, DSNs, API/account/access keys; server metadata remains tracked by #1399.
• Restore limited to 1000 entries: confirmed restore falls back to apply-by-ID with an explicit diff unavailable result; dry-run refuses unsafe previewless restore.
• Sequential/fatal help validation: one request per subsystem, with missing or incomplete metadata downgraded to warnings.
• Unusable parse-failure placeholder: best-effort per-line redaction preserves non-secret syntax and truncates sensitive malformed assignments.
• Coverage gap: added full-target delete diff coverage.

BREAKING contract note

BREAKING: This PR updates the protected docs/reference/rc/admin.md command behavior contract. It does not change output v1/v2/v3 schemas, local config schema, or exit-code definitions. The new commands are additive and do not require data migration.

Validation

Exact head: ceb905d

• cargo fmt --all --check
• CARGO_BUILD_JOBS=2 cargo clippy --workspace -- -D warnings
• CARGO_BUILD_JOBS=2 cargo test --workspace
• Core configuration unit tests: 10 passed
• CLI configuration unit tests: 17 passed
• CLI configuration integration tests: 10 passed
• Help contract tests: 3 passed
• Review thread audit on feat(rc-admin)!: add safe server configuration management #283: 1 changes-requested review, 0 review threads; every finding above was re-audited after implementation

Limitations

• RustFS does not expose revision or ETag tokens, so mutations cannot provide atomic compare-and-swap protection.
• The current history API has no cursor or by-ID preview endpoint. An older restore ID can be applied only after confirmation and cannot produce a safe dry-run diff.
• Server-side history storage and default redaction remain tracked by #1399; the CLI defensively redacts all displayed history.
• Preservation-safe server rollback semantics remain tracked by #1398. Users must review the diff or explicit diff unavailable warning before confirmation.