retrofit: extend method-decomposition with SettingsController public API (5 REQs / 18 methods)

[rubenvdlinde]

Retrofit — Reverse-Spec (extend)

Extends the existing method-decomposition capability with 5 retrofit REQs (REQ-DECOMP-013..017) covering 18 SettingsController public methods that fall outside REQ-DECOMP-001's named scope.

Ghost change: retrofit-2026-05-24-method-decomposition. Frontmatter uses block-YAML retrofit_extensions: [REQ-DECOMP-013..017].

What this PR does

• Drafts 5 REQs grouped by behavioural cluster:
  • REQ-DECOMP-013: Settings CRUD (index, create, getGeneralConfig, updateGeneralConfig, getSyncConfig, updateSyncConfig)
  • REQ-DECOMP-014: Configuration bootstrap + status (load, initialize, status, getVersionInfo)
  • REQ-DECOMP-015: Sync orchestration (getSyncStatus, performSync)
  • REQ-DECOMP-016: Cache + heartbeat diagnostics (clearCache, heartbeat, stats, debug)
  • REQ-DECOMP-017: Progress snapshot + SSE streaming (getProgress, streamProgress)
• Annotates 18 methods with @spec tags
• Notes flag 3 concrete bugs: empty-if blocks inverting HTTP status codes in performSync (incremental success returns 500) and resetAutoConfig (success returns 400), plus missing @NoAdminRequired on general config endpoints. Same bug pattern as PR retrofit: reverse-spec progress-tracking (5 REQs / 9 methods) #288's progress-tracking#calculateOverallPercentage.

What this PR does NOT do

• No code behavior changes — annotations only
• Does not fix the empty-if bugs (flagged for follow-up issues)
• 23 remaining SettingsController misc methods deferred to future passes (autoConfigure, resetAutoConfig, manualImport, forceUpdate, ArchiMate import/export, email transport, etc.)
• 6 other large misc clusters (SettingsService, SoftwareCatalogueService, ArchiMate services, ContactPersonHandler) defer until cluster splitting per file

Review focus

• REQ language matches observed behaviour (not aspirational)
• HTTP status mapping accuracy per endpoint
• Behavioural grouping coherence (each REQ has a defensible theme)

Source: `openspec/coverage-report.md` generated 2026-05-24 | Cluster: `method-decomposition` (Bucket 2a)

Umbrella: #285

[github-actions]

Quality Report — ConductionNL/softwarecatalog @ aec1683

Check	PHP	Vue	Security	License	Tests
lint	❌
phpcs	❌
phpmd	❌
psalm	❌
phpstan	❌
phpmetrics	❌
eslint		✅
stylelint		✅
composer			❌	❌
npm			✅	❌ 2/846 denied
PHPUnit					⏭️
Newman					⏭️
Playwright					⏭️

❌ Denied npm licenses

Package	Version	License
pako	1.0.11	(MIT AND Zlib)
sha.js	2.4.12	(MIT AND BSD-3-Clause)

---

Quality workflow — 2026-05-24 18:59 UTC

Download the full PDF report from the workflow artifacts.