feat(#94): implement spoke configuration UI

Implements the final piece of M7-Federation - the spoke configuration UI
that allows administrators to configure their local instance's federation
capabilities and settings.

Backend Changes:
- Add UpdateInstanceDto with validation for name, capabilities, and metadata
- Implement FederationService.updateInstanceConfiguration() method
- Add PATCH /api/v1/federation/instance endpoint to FederationController
- Add audit logging for configuration updates
- Add tests for updateInstanceConfiguration (5 new tests, all passing)

Frontend Changes:
- Create SpokeConfigurationForm component with PDA-friendly design
- Create /federation/settings page with configuration management
- Add regenerate keypair functionality with confirmation dialog
- Extend federation API client with updateInstanceConfiguration and regenerateInstanceKeys
- Add comprehensive tests (10 tests, all passing)

Design Decisions:
- Admin-only access via AdminGuard
- Never expose private key in API responses (security)
- PDA-friendly language throughout (no demanding terms)
- Clear visual hierarchy with read-only and editable fields
- Truncated public key with copy button for usability
- Confirmation dialog for destructive key regeneration

All tests passing:
- Backend: 13/13 federation service tests passing
- Frontend: 10/10 SpokeConfigurationForm tests passing
- TypeScript compilation: passing
- Linting: passing
- PDA-friendliness: verified

This completes M7-Federation. All federation features are now implemented.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/web/src/lib/api/federation.ts

@@ -3,7 +3,7 @@
  * Handles federation connection management API requests
  */
 
-import { apiGet, apiPost } from "./client";
+import { apiGet, apiPost, apiPatch } from "./client";
 
 /**
  * Federation connection status
@@ -169,6 +169,33 @@ export async function fetchInstanceIdentity(): Promise<PublicInstanceIdentity> {
   return apiGet<PublicInstanceIdentity>("/api/v1/federation/instance");
 }
 
+/**
+ * Update instance configuration request
+ */
+export interface UpdateInstanceRequest {
+  name?: string;
+  capabilities?: FederationCapabilities;
+  metadata?: Record<string, unknown>;
+}
+
+/**
+ * Update this instance's configuration
+ * Admin-only operation
+ */
+export async function updateInstanceConfiguration(
+  updates: UpdateInstanceRequest
+): Promise<PublicInstanceIdentity> {
+  return apiPatch<PublicInstanceIdentity>("/api/v1/federation/instance", updates);
+}
+
+/**
+ * Regenerate instance keypair
+ * Admin-only operation
+ */
+export async function regenerateInstanceKeys(): Promise<PublicInstanceIdentity> {
+  return apiPost<PublicInstanceIdentity>("/api/v1/federation/instance/regenerate-keys", {});
+}
+
 /**
  * Mock connections for development
  */