Fix settings save blocking event loop and overwriting config keys

- Run apply_settings in thread pool executor to prevent engine reload
  from blocking the HTTP response (caused "TypeError: Failed to fetch")
- Flatten nested config objects into dot-notation keys before saving
  so partial updates don't wipe out unincluded keys like auth_token

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/api_server.py

@@ -212,7 +212,11 @@ class APIServer:
 
         @app.put("/api/config")
         async def update_config(update: ConfigUpdate):
-            engine_reloaded, message = ctrl.apply_settings(update.settings)
+            import asyncio
+            loop = asyncio.get_event_loop()
+            engine_reloaded, message = await loop.run_in_executor(
+                None, ctrl.apply_settings, update.settings
+            )
             return {
                 "status": "ok",
                 "message": message,