feat(realism): operator-tunable planner weights via realism_config

New realism_config table (uuid PK + unique key) + two repo methods
(get/set) backs an admin-only GET/PUT /api/v1/realism/config surface.

The planner now exposes apply_payload(payload) / current_payload() /
reset_to_defaults() and reads its weights through mutable module
globals; pick() resolves the live values each call. Validation
catches negative weights, zero totals, out-of-range canary_probability,
unknown content_class names, and silently drops cross-list entries
(canary class on the user list, etc).

The orchestrator worker calls _refresh_realism_config(repo) on
startup and every 5 ticks (~5min at 60s interval). Operator changes
land within one refresh window with no bus signal — the simpler path
for a knob whose latency tolerance is minutes.

decnet/web/db/repository.py

@@ -1159,6 +1159,28 @@ class BaseRepository(ABC):
         """Single synthetic_files row by uuid, or ``None``."""
         raise NotImplementedError
 
+    async def get_realism_config(
+        self, key: str,
+    ) -> Optional[dict[str, Any]]:
+        """Read one ``realism_config`` row by key.
+
+        Today only ``key="weights"`` is used; the schema is
+        single-row-per-key so future tunables can land without a new
+        table. Returns ``None`` when the key has never been set —
+        callers fall back to hardcoded defaults in
+        :mod:`decnet.realism.planner`.
+        """
+        raise NotImplementedError
+
+    async def set_realism_config(
+        self, key: str, value: str,
+    ) -> None:
+        """Upsert one ``realism_config`` row. Last-write-wins.
+
+        *value* is opaque JSON text; validation belongs to the API
+        layer (the planner only reads what landed)."""
+        raise NotImplementedError
+
     async def pick_random_synthetic_file_for_edit(
         self,
         decky_uuid: str,