feat(retrieval): the operator can see what was tuned, and every write is recorded (#4102)

The other half of the bargain in milestone 416 step 4. The model moves
these dials; this is what makes that reviewable rather than merely
automatic.

THE HOLE THIS CLOSES

Every retrieval floor is an ordinary settings key, and `/api/settings`
accepts any key at all. A floor written through it landed correctly and
recorded nothing — a tuning history with holes in it, which is worse
than no history because it reads as complete.

So the generic endpoint now routes registry-owned keys through
`set_dial` instead of writing them as plain rows. ROUTED, not refused:
refusing would only work for callers that had been updated, while this
way the form, a script, and an old client all leave the trail, and
there is no version of "forgot to use the other endpoint". Clearing a
control is written as an explicit set back to the shipped default,
because the operator reverting something is the single most important
move this history can record.

`set_dial` now also refuses to record a no-op. The Settings form
re-sends every field on every save, so without that one press of Save
would write six rows saying the operator set six dials to the numbers
they were already on — and a history nobody can skim is one nobody
reads.

WHAT THE OPERATOR GETS

`/api/retrieval/surfaces`, `/surfaces/<name>` and `/tuning-history`,
with `actor` fixed server-side rather than taken from the payload: a
payload-supplied actor would let a model claim to be the operator, and
"did I do this, or did the session?" is the first question this list
is asked.

In Settings: the five missing BUDGETS (until now only auto-inject had
one, so the only control over a noisy surface was to raise its bar —
which discards that surface's best candidates along with its worst),
and a "What has been tuned" panel showing each change, who made it, and
the reason given. The operator's own changes are marked.

The MCP tool demands a reason; these endpoints do not. That asymmetry
is deliberate and stated in routes/retrieval.py: the requirement exists
to make the MODEL read the records before moving a number on someone
else's behalf, and the operator is that someone — a mandatory
justification box on every control would be friction charged to the one
participant who owes no explanation.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01821k5B3Ysecp9fNYs92Kuy

src/scribe/services/retrieval_tuning.py

@@ -162,6 +162,21 @@ async def set_dial(
         applied = float(min(MAX_BUDGET, max(1, int(float(value)))))
         key, stored = s.budget_key, str(int(applied))
 
+    # A change to the value it already has is not a change, and must not be
+    # written. The Settings form re-sends every field on every save, so without
+    # this the history fills with rows saying the operator set six dials to the
+    # numbers they were already on — and a history nobody can skim is one
+    # nobody reads, which costs the surface its entire purpose.
+    #
+    # Reported rather than silently skipped, so a caller that expected to move
+    # something learns that it did not.
+    if abs(applied - old) < 1e-9:
+        return {
+            "surface": surface, "dial": dial, "previous": old,
+            "applied": applied, "clamped": abs(applied - float(value)) > 1e-9,
+            "reason": text, "actor": actor, "unchanged": True,
+        }
+
     await set_setting(user_id, key, stored)
     async with async_session() as session:
         session.add(RetrievalTuningEvent(
@@ -181,6 +196,9 @@ async def set_dial(
         "clamped": abs(applied - float(value)) > 1e-9,
         "reason": text,
         "actor": actor,
+        # Always present, both ways round: a caller that has to test for the
+        # key's absence to learn the answer will eventually forget to.
+        "unchanged": False,
     }