- Add GET /api/admin/settings for configuration retrieval
- Add PATCH /api/admin/settings with validation (30-365 days)
- Implement TTL index update when retention period changes
- Add last admin protection (cannot demote last active admin)
- Add audit logging for admin actions (ADMIN_UPDATE_SETTINGS, etc.)
- 45/52 Phase 4 tests passing (7 rate limiting tests not in scope)