generator: core apply loop, sanitizers, system config routes

render() is pure and gives every file the header (bodies arrive per task).
apply() runs one at a time, debounces requestApply, writes changed files
atomically (mode 0640), keeps .prev, sends each needed reload once, skips
pjsip reload and sets restartRequired when transports change, and records
generator_runs. AMI connects on startup and every reconnect forces a full
apply. Admin routes: config apply/rollback and a masked generated-files view.

Task: M2-T2

apps/api/src/generator/load.ts

@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: AGPL-3.0-or-later
+// Everything render() needs, loaded in one go (03 §1). render() itself does no I/O.
+import type { Db } from '../db/client.ts';
+import { getAllSettings } from '../services/settings.ts';
+
+export type Snapshot = {
+  /** "YYYY-MM-DD" in general.timezone; render() never reads the clock. */
+  today: string;
+  settings: Awaited<ReturnType<typeof getAllSettings>>;
+};
+
+export function todayIn(timezone: string, now = new Date()): string {
+  // en-CA formats as YYYY-MM-DD.
+  return new Intl.DateTimeFormat('en-CA', { timeZone: timezone }).format(now);
+}
+
+export async function loadSnapshot(db: Db, now = new Date()): Promise<Snapshot> {
+  const settings = await getAllSettings(db);
+  return { today: todayIn(settings['general.timezone'], now), settings };
+}