R5 the server's own settings: instance, rules, announcements, relays, media limits, the staff's log

A singleton ServerSettings (title, descriptions, contact, thumbnail, privacy policy, terms, rules, relays, media
overrides, PublishActivity), cached by InstanceSettings and read by the instance API, NodeInfo, the instance actor, the
web pages and the mailer; its defaults are the old literals, so nothing changes until an administrator edits.
/clientapi/admin/settings (and /thumbnail), /announcements, /relays for administrators; /clientapi/moderator/log, the
staff's log (AdminAction, written by domain blocks, backups, settings and the CLI; no IP, never a root paired with its
personas). The Mastodon API's rules, extended description, privacy policy, terms of service, domain blocks (Published,
Obfuscate), announcements (dismiss, reactions, streaming) and activity (only when published). Reports carry rule ids.
Media overrides clamped to hard caps. Relays named by the settings reconcile next to the configured ones.

Verified: interop.sh instance accounts relay with mastodon, relay, aoderelay and mailpit, 119 passed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WpVCoDeM1qUTRp4fXQdfof

PrivaPub/Models/ServerSettings.cs

@@ -0,0 +1,65 @@
+using MongoDB.Entities;
+
+namespace PrivaPub.Models
+{
+	// The server's own settings (completion program R5), edited from the administrator's page: one document with the fixed
+	// id `settings`, read through IInstanceSettings (Domain/Instance/InstanceSettings.cs). While none exists, Defaults() is
+	// what PrivaPub served and sent before the settings existed, word for word, so nothing changes until an administrator
+	// saves. A backup holds it, and a restore keeps the live one (ProtectiveMerge).
+	public class ServerSettings : Entity
+	{
+		public const string Name = "settings";
+		public const string DefaultTitle = "PrivaPub";
+		public const string DefaultDescription = "A small ActivityPub server where one private login keeps several unlinkable public personas.";
+		public const string DefaultThumbnailPath = "/media/missing-header.png";
+		public static readonly DateTime DefaultPrivacyPolicyUpdatedAt = new(2026, 10, 4, 0, 0, 0, DateTimeKind.Utc);
+		// the privacy policy PrivaPub served before it could be edited, as Markdown: it renders to the same paragraph
+		public const string DefaultPrivacyPolicy = "One private login owns several public personas, and nobody but this server's admin can tell they belong "
+			+ "together. What a persona posts is shared as its visibility says; a located post never leaves this server. "
+			+ "Uploads lose their metadata. Statistics name servers, never people: see /stargazing.";
+
+		public string Title { get; set; } = DefaultTitle;
+		public string ShortDescription { get; set; } = DefaultDescription;
+		public string Description { get; set; } = DefaultDescription;//Markdown
+		public DateTime? DescriptionUpdatedAt { get; set; }//null: the description was never edited (it then answers today)
+		public string ContactEmail { get; set; }
+		public string ContactAccountId { get; set; }//a local persona the administrator chose: publicly tied to running the server
+		public string ThumbnailMediaId { get; set; }//its MediaAttachment (ServerUse "thumbnail")
+		public string ThumbnailUrl { get; set; }//null: /media/missing-header.png
+		public string PrivacyPolicy { get; set; } = DefaultPrivacyPolicy;//Markdown
+		public DateTime? PrivacyPolicyUpdatedAt { get; set; } = DefaultPrivacyPolicyUpdatedAt;
+		public string TermsOfService { get; set; }//Markdown; null: the server has none (the API answers 404)
+		public DateTime? TermsEffectiveAt { get; set; }
+		public List<ServerRule> Rules { get; set; } = new();//soft-deleted ones stay, so old reports keep their meaning
+		public List<string> Relays { get; set; } = new();//besides Federation:Relays
+		public ServerMediaLimits Media { get; set; } = new();
+		public List<string> StaffPicks { get; set; } = new();//account ids, for later
+		public bool PublishActivity { get; set; }//GET /api/v1/instance/activity; off by default
+		public DateTime? UpdatedAt { get; set; }//null: never saved
+		public string UpdatedBy { get; set; }//the administrator's root id, or "cli"
+
+		public static ServerSettings Defaults() => new() { ID = Name };
+
+		/// <summary>The rules shown to everyone: those not deleted, in their order.</summary>
+		public IEnumerable<ServerRule> ListedRules() => Rules.Where(r => r.DeletedAt == null).OrderBy(r => r.Position);
+	}
+
+	public class ServerRule
+	{
+		public string Id { get; set; } = Guid.NewGuid().ToString("N");
+		public string Text { get; set; }
+		public string Hint { get; set; }
+		public int Position { get; set; }
+		public DateTime? DeletedAt { get; set; }
+	}
+
+	// what the administrator changed of Media:* (MediaOptions); null keeps the configured value. Applied by
+	// Domain/Instance/MediaLimitsFromSettings within hard caps.
+	public class ServerMediaLimits
+	{
+		public long? QuotaBytesPerRoot { get; set; }
+		public long? MaxImageBytes { get; set; }
+		public long? MaxVideoBytes { get; set; }
+		public int? MaxSeconds { get; set; }
+	}
+}