Separate bootstrap settings from runtime overrides with a dedicated runtime settings manager

backend/app/tasks/health_check.py

@@ -25,6 +25,7 @@ import structlog
 from app.models.config import PendingRecovery
 from app.models.server import ServerStatus
 from app.services import health_service
+from app.utils.runtime_state import get_effective_settings
 
 if TYPE_CHECKING:  # pragma: no cover
     from fastapi import FastAPI
@@ -56,14 +57,15 @@ async def _run_probe(app: FastAPI) -> None:
     ``app.state.pending_recovery``.
 
     This is the APScheduler job callback.  It reads ``fail2ban_socket`` from
-    ``app.state.settings``, runs the health probe, and writes the result to
-    ``app.state.server_status``.
+    the effective runtime settings, runs the health probe, and writes the
+    result to ``app.state.server_status``.
 
     Args:
         app: The :class:`fastapi.FastAPI` application instance passed by the
             scheduler via the ``kwargs`` mechanism.
     """
-    socket_path: str = app.state.settings.fail2ban_socket
+    settings = get_effective_settings(app)
+    socket_path: str = settings.fail2ban_socket
     prev_status: ServerStatus = getattr(
         app.state, "server_status", ServerStatus(online=False)
     )