Let a wiki's owner decide whether API, widget and public-link runs edit it

A run from an agent's API key or widget acts as the agent's owner, so it
could rewrite any wiki the owner can edit. A new per-wiki setting,
wiki_outside_edits (off by default), decides whether such runs, and runs
from the agent's public link, get the wiki's edit actions. While it is off
they are offered only wiki_view, and the tool refuses writes itself after
reading the live setting. The owner changes it through the owner-only
/api/sources/<id>/wiki/settings route; tokens can read it but not change it.

tests/api/test_pat_rules.py

@@ -98,6 +98,8 @@ class TestClassification:
             ("/api/devices/pairings", "POST"),
             ("/api/connectors/auth", "GET"),
             ("/api/mcp_server/callback", "GET"),
+            ("/api/resource_settings", "PUT"),
+            ("/api/sources/<string:source_id>/wiki/settings", "PUT"),
         ],
     )
     def test_sensitive_routes_are_never_token_reachable(self, rule, method):