feat: journal:fix-headings and the settings API

- classes.FixStoredHeadings converts stored H1 in post content (every
  locale) and category pillar text, in one transaction with a RecordSaved
  and a site cache purge per changed record
- journal:fix-headings, a dry run unless --apply, refuses with exit code 1
  while the H1 setting is off
- GET/PUT /_journal/api/v1/settings and POST /fix-headings {dry_run} for
  golem15.journal.manage_settings; 409 with the refusal while the setting
  is off

controllers/posts.go

@@ -30,6 +30,9 @@ const (
 	// PermissionAccessImportExport gates journal:export-posts / import-posts
 	// toolbar actions (D-13).
 	PermissionAccessImportExport = "golem15.journal.access_import_export"
+	// PermissionManageSettings is the Journal settings permission; the
+	// /_journal/api/v1 settings and fix-headings routes require it.
+	PermissionManageSettings = "golem15.journal.manage_settings"
 )
 
 type postsAdminController struct {