feat(project): Add superuser settings endpoint

[vprashrex]

Issue

Closes #1084

Summary

Superusers previously had no way to change project-level settings (e.g. Langfuse tracing) for projects in other organizations — the existing PATCH /projects/settings endpoint only operates on the project bound to the caller's API key. This PR adds a project-scoped settings endpoint that lets superusers patch any project's settings across organizations.

• New endpoint: PATCH /projects/{project_id}/settings — patches the project's settings JSONB (currently tracing: bool). Only keys provided in the body are changed; existing keys are preserved.
• Authorization: superusers may target any project in any organization. A non-superuser project-scoped key may only target its own bound project; targeting any other project_id returns 403.
• Validation: empty body returns 400 (No settings provided); missing or inactive projects return 404 via validate_project.
• API docs: added superuser_update_settings.md describing the settings shape and access scope.
• Tests: cover superuser cross-org update, merge with existing settings keys, empty body 400, not-found 404, inactive-project 404, and non-superuser cross-project 403.

Checklist

Before submitting a pull request, please ensure that you mark these task.

• Ran fastapi run --reload app/main.py or docker compose up in the repository root and test.
• If you've fixed a bug or added code that is tested and has test cases.

Notes

No schema/migration changes — reuses the existing ProjectSettingsUpdate model and update_project_settings CRUD. The existing key-scoped PATCH /projects/settings endpoint is unchanged.

[coderabbitai]

Warning

Review limit reached

Next included review available in 31 minutes.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 1f1c438d-470f-4790-a3bf-dc86d046de08

📥 Commits

Reviewing files that changed from the base of the PR and between f081a66 and ec3c006.

📒 Files selected for processing (4)

• backend/app/api/docs/projects/superuser_update_settings.md
• backend/app/api/routes/project.py
• backend/app/tests/api/routes/test_project.py
• docs/wiki/modules/tenancy.md

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

OpenAPI changes   🟢 1 non-breaking change

Tip

Safe to merge from an API-contract perspective.

Full changelog  ·  1

	Method	Path	Change
🟢	PATCH	/api/v1/projects/{project_id}/settings	endpoint added

_{main ↔ 2f594c77 · generated by oasdiff}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!