feat(FN-2952): validate unavailableNodePolicy in PUT /settings

Adds server-side validation for the `unavailableNodePolicy` field on the
PUT /api/settings route. Accepts only `block` or `fallback-local`;
rejects unknown strings and non-string values with 400.

- packages/dashboard/src/routes/register-settings-memory-routes.ts:
  call `validateUnavailableNodePolicy` and throw `badRequest` on invalid input
- packages/dashboard/src/__tests__/routes.test.ts: cover accept,
  invalid-value, and non-string cases

Fusion-Task-Id: FN-2952

packages/dashboard/src/__tests__/routes.test.ts

@@ -14401,6 +14401,53 @@ describe("PUT /settings", () => {
     expect(store.updateSettings).not.toHaveBeenCalled();
   });
 
+  it("accepts unavailableNodePolicy fallback-local", async () => {
+    const updatedSettings = {
+      ...DEFAULT_SETTINGS,
+      unavailableNodePolicy: "fallback-local",
+    };
+    (store.updateSettings as ReturnType<typeof vi.fn>).mockResolvedValue(updatedSettings);
+
+    const res = await REQUEST(
+      buildApp(),
+      "PUT",
+      "/api/settings",
+      JSON.stringify({ unavailableNodePolicy: "fallback-local" }),
+      { "Content-Type": "application/json" },
+    );
+
+    expect(res.status).toBe(200);
+    expect(store.updateSettings).toHaveBeenCalledWith({ unavailableNodePolicy: "fallback-local" });
+  });
+
+  it("rejects invalid unavailableNodePolicy values", async () => {
+    const res = await REQUEST(
+      buildApp(),
+      "PUT",
+      "/api/settings",
+      JSON.stringify({ unavailableNodePolicy: "auto-retry" }),
+      { "Content-Type": "application/json" },
+    );
+
+    expect(res.status).toBe(400);
+    expect(res.body.error).toContain("unavailableNodePolicy");
+    expect(store.updateSettings).not.toHaveBeenCalled();
+  });
+
+  it("rejects non-string unavailableNodePolicy values", async () => {
+    const res = await REQUEST(
+      buildApp(),
+      "PUT",
+      "/api/settings",
+      JSON.stringify({ unavailableNodePolicy: 42 }),
+      { "Content-Type": "application/json" },
+    );
+
+    expect(res.status).toBe(400);
+    expect(res.body.error).toContain("unavailableNodePolicy");
+    expect(store.updateSettings).not.toHaveBeenCalled();
+  });
+
   it("returns 500 on store update error", async () => {
     (store.updateSettings as ReturnType<typeof vi.fn>).mockRejectedValue(new Error("Write failed"));
 

packages/dashboard/src/routes/register-settings-memory-routes.ts

@@ -35,6 +35,7 @@ import {
   validateBackupRetention,
   validateBackupSchedule,
   validateImportData,
+  validateUnavailableNodePolicy,
   writeInsightsMemory,
   writeMemory,
   writeProjectMemoryFile,
@@ -334,6 +335,13 @@ export function registerSettingsMemoryRoutes(ctx: ApiRoutesContext, deps: Settin
       ) {
         throw badRequest("archiveAgentLogMode must be one of: none, compact, full");
       }
+      if (clientSettings.unavailableNodePolicy !== undefined) {
+        const validatedUnavailableNodePolicy = validateUnavailableNodePolicy(clientSettings.unavailableNodePolicy);
+        if (validatedUnavailableNodePolicy === undefined) {
+          throw badRequest("unavailableNodePolicy must be one of: block, fallback-local");
+        }
+        clientSettings.unavailableNodePolicy = validatedUnavailableNodePolicy;
+      }
 
       // Validate memoryBackendType if provided - must be string or null (for explicit clear)
       // Unknown backend IDs are accepted and persisted verbatim (for custom backend compatibility)