fix: make server discovery and audits read-only

src/main/config-store.cjs

@@ -142,6 +142,19 @@ class ConfigStore {
     return this.saveQueue;
   }
 
+  async createRecoverySnapshot(reason = 'configuration-change') {
+    await this.saveQueue.catch(() => {});
+    const safeReason = String(reason || 'configuration-change').toLowerCase().replace(/[^a-z0-9._-]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80) || 'configuration-change';
+    const timestamp = new Date().toISOString().replace(/[:.]/g, '-');
+    const snapshotDirectory = path.join(path.dirname(this.filePath), 'snapshots');
+    const snapshotPath = path.join(snapshotDirectory, `${timestamp}-${safeReason}.json`);
+    await fs.mkdir(snapshotDirectory, { recursive: true });
+    await fs.writeFile(snapshotPath, `${JSON.stringify(this.data, null, 2)}\n`, { mode: 0o600, flag: 'wx' });
+    try { await fs.chmod(snapshotDirectory, 0o700); } catch {}
+    try { await fs.chmod(snapshotPath, 0o600); } catch {}
+    return { filePath: snapshotPath, reason: safeReason, createdAt: new Date().toISOString() };
+  }
+
   setToken(token, { preserveExisting = false } = {}) {
     const value = String(token || '').trim();
     if (!value && preserveExisting && this.getToken()) return { persistent: Boolean(this.data.gitea.encryptedToken), preserved: true };