fix(config): validate RIExchangeMode on PUT /api/config #1196

PUT /api/config unmarshals the body onto GlobalConfig wholesale, and GlobalConfig.Validate never constrains RIExchangeMode. So a typo, "" or "Auto" is stored as-is (see the armed() comment at internal/api/handler.go:570-580). The RI-exchange config endpoint does validate the mode (internal/api/handler_ri_exchange.go:2845, only manual or auto).

Today the scheduler routes every non-manual value to auto-execution. After LeanerCloud/cloud-commitments-go#578, RunAutoExchange fails closed on anything other than exactly auto or manual. A stored bad value then makes the scheduled run fail loudly instead of auto-executing. That is safer, but it surfaces a config the API should never have accepted.

Fix:

• Validate RIExchangeMode (manual | auto) on PUT /api/config, preferably in GlobalConfig.Validate so every writer is covered, with the same error the RI-exchange endpoint returns.
• Add tests for the typo, "" and "Auto" cases.
• Once only manual and auto can be stored, update the armed() comment. Keep armed() itself fail-safe (!= "manual") for rows already stored with bad values.
• Consider a one-off check or a migration note for existing rows with an invalid mode before bumping the go pin past fix(api): GET /api/purchases/cancel/{id} cancels an execution on a side-effecting GET #578.

Reported by the cloud-commitments-go agent; confirmed against origin/main 31a31816.