Admin UI config backfill for semaphore sync

[jung-thomas]

Problem

The semaphore.sync.* tuning keys are raw ImsConfig rows with no Admin UI surface. Operators must hand-edit the DB to configure the semaphore-tag-sync job — the exact friction Tom has repeatedly called out ("adding feature flags but not exposing them in the UI").

The feature flag (flag.semaphore.sync → SEMAPHORE_SYNC_ENABLED) is in the Admin UI feature-flags panel. The tuning keys are not.

Keys to expose (all ImsConfig)

Key	Type	Default	Notes
semaphore.sync.model	string	SAPCore	SES model name
semaphore.sync.lang	string	en
semaphore.sync.filter	string	(none)	SES FILTER clause, e.g. CL=Topic — shrinks the 61 MB fetch
semaphore.sync.actualTagClasses	csv	(none)	class names/URIs (mapper-only today)
semaphore.sync.interestItemClasses	csv	(none)	class names/URIs (mapper-only today)
semaphore.sync.intakeClasses	csv	(none)	Tier-2 intake allowlist — unmatched terms INSERT only if class-listed; empty = adopt-only
semaphore.sync.dryRun	bool	true	first live runs report the plan without writing

Acceptance

• These keys are editable from the Admin UI config/feature-flags surface (same place as flag.semaphore.sync).
• Reads still fall back to the documented defaults when a key is absent.
• No behavior change to readConfig in srv/jobs/semaphore-tag-sync-job.js — the UI writes the same ImsConfig rows it already reads.

Ref: #2184 (semaphore-tag-sync).