## Why

ServerDetailPage currently previews config diffs locally and then creates a generic `config.write` job directly from the browser. The route catalog still lists config diff review and file operation dispatch as future work. Operators need a platform-mediated, auditable flow that validates config versions and dispatches scoped run jobs without leaking host paths or credentials.

## What Changes

- Add backend config diff preview and config write approval workflows.
- Add scoped file operation dispatch contracts for safe file read/write jobs.
- Move config write dispatch out of generic frontend job creation and into platform-owned service methods.
- Keep explicit user confirmation before any write job is dispatched.
- Update frontend config and AI suggestion write paths to use approved platform routes.

## Capabilities

### New Capabilities

- `config-write-and-file-dispatch`: Safe config diff review, approval, and scoped file operation dispatch.

### Modified Capabilities

- `server-management-workflows`: Server detail config writes use platform lifecycle/file dispatch rules instead of direct generic job creation.

## Impact

- Affects `platform/` domain, DTO, validators, service, API handlers, route/protocol docs, and tests.
- Affects `run/` protocol validation for scoped config/file job payloads.
- Affects `platform_web/` ServerDetailPage config and AI suggestion apply flows.
- Does not add unrestricted file browsing, raw path exposure, billing, cloud sales, or direct plugin-to-run access.