One invalid stored host setting crashes boot on every worker #497

Tier 1: correctness / availability

Problem

_preapp_config.merge_host_settings catches only _parse errors (ValueError, JSONDecodeError), then calls Settings(**values) with no guard (_preapp_config.py, about line 226). A value that parses but fails validation raises ValidationError at boot. This was reproduced with log_format='xml' against its Literal.

Runtime hydration does the opposite: modules/settings/settings/hydrate.py:88-101 drops fields that fail validation and continues.

So a stale row, or a Literal/range narrowed in an upgrade, takes down every worker. The setup wizard or admin UI that could fix the row never comes up.

Fix

• Reuse the lenient drop-invalid-fields loop from hydrate.py in merge_host_settings, logging each dropped field at WARNING.
• _parse is duplicated between _preapp_config.py and settings/hydrate.py; keep a single shared copy in framework code.
• Add a test: a stored value that fails validation boots with the default and logs a warning.

Also worth doing here: the pre-app read and _secret_key.py:140 each spin up a thread, an event loop and a NullPool engine, so boot opens three DB connections before the app exists. Reading overrides and the secret key in one pass removes one failure point.