refactor(settings): one bounded_float for every numeric bar read from settings

The shape ledger's divergence readout flagged _gate_setting (#4385).
Reading it turned up a family with no canon: floor_for,
get_duplicate_threshold, get_plan_match_threshold and _gate_setting each
parsed a stored string, fell back to the default (never 0) and clamped
into [lo, 1].

- services/settings.bounded_float(raw, default, lo=0, hi=1) is the pure
  parse, fallback and clamp. Each caller keeps its own get_setting read,
  so tests patching get_setting per module still take effect, and
  _gate_setting still fails open on an unreadable setting.
- SettingsView.saveKbInject: eleven inline Math.min/Math.max clamps and
  the local gateAt become one asBar(v, d, lo = 0), mirroring the server.

No behaviour change.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/scribe/services/settings.py

@@ -16,6 +16,22 @@ logger = logging.getLogger(__name__)
 SECRET_MASK = "********"
 
 
+def bounded_float(raw: str | None, default: float, lo: float = 0.0, hi: float = 1.0) -> float:
+    """A numeric setting as stored text, parsed and clamped to [lo, hi].
+
+    Every similarity bar and retrieval floor is kept as a string and read the
+    same way: an unparseable value falls back to the DEFAULT, never to 0 (a
+    floor of 0 admits everything), and a value out of range is pulled back
+    into it. Pure on purpose: each caller keeps its own `get_setting` read, so
+    what can fail there — and whether that fails open — stays the caller's.
+    """
+    try:
+        value = float(raw)
+    except (TypeError, ValueError):
+        value = default
+    return min(hi, max(lo, value))
+
+
 async def get_admin_setting(key: str, default: str = "") -> str:
     """Read an instance-global setting (one stored on an admin account).