feat(settings): add configurable per-repo blacklistLabel (#1425)

[JSONbored]

Summary

Adds blacklistLabel — a per-repo configurable label (default slop) the converged engine will
apply to a blacklisted contributor's PR/issue — wired with full config-as-code parity so it can be
set from the dashboard/API and as code in .gittensory.yml. This is the management/config layer of
the anti-abuse contributor blacklist (#1425); the engine disposition that reads these settings to
label-and-close a banned author lands in the immediate follow-up PR.

The label is configurable (not hard-coded) so the disposition works regardless of the label a repo uses,
mirroring the existing gittensorLabel setting end to end.

What's wired (every parity site, one PR)

• DB: new blacklist_label column (migrations/0073_blacklist_label.sql) + Drizzle schema, default slop.
• Types: RepositorySettings.blacklistLabel (optional; DB always populates it, mirrors the sibling contributorBlacklist).
• Resolver: .gittensory.yml settings.blacklistLabel parsed in the focus manifest (> DB > default).
• API: OpenAPI RepositorySettings schema + the settings route (request/response), regenerated openapi.json.

Scope

• Narrow, in wantedPaths; no site/ / CNAME / lovable; no changelog edit.
• Config-as-code parity in a single PR (DB + types + resolver + OpenAPI + route).
• No secrets / wallets / hotkeys / trust scores / private values; logins are public data only.

Validation

• npm run typecheck
• npm run db:migrations:check (contiguous 0001..0073, next free 0074)
• npm run ui:openapi:check (regenerated, matches)
• npm run test:coverage — full suite green; 100% of changed lines and branches covered (DB round-trip + .gittensory.yml resolution tests).

Safety

• No new auth/CORS/session surface; the new field is a label string with min(1).max(50) validation.
• No private terms in code/tests/PR text.

Advances #1425.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	eb90475	Commit Preview URL Branch Preview URL	Jun 26 2026, 07:48 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.39%. Comparing base (a356441) to head (eb90475).
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1430   +/-   ##
=======================================
  Coverage   95.39%   95.39%           
=======================================
  Files         193      193           
  Lines       20929    20932    +3     
  Branches     7564     7566    +2     
=======================================
+ Hits        19966    19969    +3     
  Misses        383      383           
  Partials      580      580           

Files with missing lines	Coverage Δ
src/api/routes.ts	94.60% <ø> (ø)
src/db/repositories.ts	96.11% <100.00%> (+<0.01%)	⬆️
src/db/schema.ts	68.32% <ø> (ø)
src/openapi/schemas.ts	100.00% <ø> (ø)
src/signals/focus-manifest.ts	98.13% <100.00%> (+<0.01%)	⬆️

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.