Operational settings resolution (MHPAY-34)

Layers

env defaults (bootstrap)
  -> platform settings (DB singleton PlatformSettings)
    -> organization quota (OrganizationQuota)
      -> location override (future)

What belongs where

Layer	Examples	Storage
Bootstrap / secrets	JWT, Postgres, seed admin, Syrve connection passwords	Env / secret provider only
Platform operational	Upload defaults and matching tolerance; legacy sync/write capability columns deprecated	Platform env section + PlatformSettings table
Organization quota	Per-tenant limits; legacy Syrve/iiko capability columns deprecated	OrganizationQuotas table
Location (future)	Per-location overrides	Not implemented in MHPAY-34

Runtime controls

• Bank statement upload: IEffectiveOperationalSettingsService + IOrganizationQuotaService.EnsureBankStatementUploadAllowedAsync (AND of platform + quota).
• Syrve/iiko: registered Pay-host capabilities are always on. Legacy platform/quota capability columns are ignored. Payment execution remains protected by scoped RBAC, mandatory manual approval, idempotency, business/anomaly checks, server applicability and required transport preflight.

Audit

Updates to platform settings and organization quota write AuditLogEntry with field-level old/new values (no secrets).

RBAC

Action	Permission
View org quota	organization.quotas.view
Update org quota	platform.quotas.manage
View platform settings	platform.settings.view
Update platform settings	platform.settings.manage