fix(security): restrict global settings updates

[nightcityblade]

Description

Fixes #4146.

Restore the superuser authorization check for POST /api/v1/settings without reintroducing the unrelated changes from the reverted security PR. Non-superusers now receive a 403 response before either settings persistence path can run.

Acceptance Criteria

• Only superusers can modify the global LLM or vector database settings.
• A regression test verifies that a non-superuser receives the expected 403 response.
• The existing settings read endpoint is unchanged.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Code refactoring
• Other (please specify):

Screenshots

N/A — this is a non-visual API authorization change. Local verification:

uv run pytest -q cognee/tests/unit/api/test_settings_router_authorization.py
1 passed

REQUIRE_AUTHENTICATION=false ENABLE_BACKEND_ACCESS_CONTROL=false uv run pytest -q cognee/tests/api/test_conditional_authentication_endpoints.py -k settings
1 passed, 9 deselected

uv run ruff check cognee/api/v1/settings/routers/get_settings_router.py cognee/tests/unit/api/test_settings_router_authorization.py
All checks passed!

Pre-submission Checklist

• I have tested my changes thoroughly before submitting this PR (See CONTRIBUTING.md)
• This PR contains minimal changes necessary to address the issue/feature
• My code follows the project's coding standards and style guidelines
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation (if applicable)
• All new and existing tests pass (targeted new and existing settings tests pass; full suite was not run)
• I have searched existing PRs to ensure this change hasn't been submitted already
• I have linked any relevant issues in the description
• My commits have clear and descriptive messages

DCO Affirmation

I affirm that all code in every commit of this pull request conforms to the terms of the Topoteretes Developer Certificate of Origin.

[github-actions]

Hello @nightcityblade, thank you for submitting a PR! We will respond as soon as possible.