fix(security): one settings decoder, and the last creation path

Round-four review follow-ups.

Every reader of app_settings now shares decodeSettingValue. The previous
commit taught the GET handler to decode, which on a legacy SQLite install
made the tab show devtools protection as disabled while
readBooleanSetting — parsing once, getting the string 'false', rejecting
it — left new galleries with it enabled. A decoder used by only some
readers is worse than none, because the UI and the behaviour disagree.
readBooleanSetting, getImageSecurityDefaults, the v1 devtools fallback
and the settings GET all use it now.

Standalone contract conversion covered. contract/conversions.js takes
Path B and inserts its own event row when the contract has no source
quote, so signed standalone contracts were the last path still landing
on the migration-038 column defaults.

Refs #1296

backend/__tests__/integration/imageSecurityDefaults.test.js

@@ -24,10 +24,11 @@ describe('image-security creation defaults', () => {
   let cleanup;
   let getImageSecurityDefaults;
   let resolveImageSecurityColumns;
+  let readBooleanSetting;
 
   beforeAll(async () => {
     ({ db, cleanup } = await bootCrmDb());
-    ({ getImageSecurityDefaults, resolveImageSecurityColumns } =
+    ({ getImageSecurityDefaults, resolveImageSecurityColumns, readBooleanSetting } =
       require('../../src/routes/adminEvents/helpers'));
   }, 120000);
 
@@ -149,6 +150,31 @@ describe('image-security creation defaults', () => {
     });
   });
 
+  describe('readBooleanSetting shares the same decoder', () => {
+    // Every reader of app_settings has to agree, or the settings tab shows
+    // protection disabled while newly created galleries turn it on.
+    const setRaw2 = async (key, raw) => {
+      await db('app_settings')
+        .insert({ setting_key: key, setting_value: raw, setting_type: 'security' })
+        .onConflict('setting_key').merge();
+    };
+
+    it('reads a double-encoded false as false, not as absent', async () => {
+      await setRaw2('enable_devtools_protection', JSON.stringify(JSON.stringify(false)));
+      expect(await readBooleanSetting('enable_devtools_protection')).toBe(false);
+    });
+
+    it('still reads a singly-encoded value', async () => {
+      await setRaw2('enable_devtools_protection', JSON.stringify(true));
+      expect(await readBooleanSetting('enable_devtools_protection')).toBe(true);
+    });
+
+    it('returns undefined for a non-boolean, so the caller keeps its default', async () => {
+      await setRaw2('enable_devtools_protection', JSON.stringify('sometimes'));
+      expect(await readBooleanSetting('enable_devtools_protection')).toBeUndefined();
+    });
+  });
+
   describe('resolveImageSecurityColumns', () => {
     it('omits every column when neither the request nor the settings supply one', () => {
       expect(resolveImageSecurityColumns({}, {})).toEqual({});