Stale zoekt_settings JSONB key permanently blocks PUT /application/settings

Summary

Split from #607625. An orphaned key (zoekt_max_restarts_15m) found in the zoekt_settings jsonb column blocks every PUT /api/v4/application/settings call, including payloads unrelated to search (e.g. {"gravatar_enabled": true}), because the JSON schema declares additionalProperties: false.

Root cause

ee/app/validators/json_schemas/application_setting_zoekt_settings.json rejects unknown keys in the zoekt_settings jsonb blob. If an unexpected key ever ends up there (manual DB edit, bug elsewhere, data migration issue, replica inconsistency, etc.), every future settings save fails until someone manually edits the database. zoekt_max_restarts_15m doesn't exist in any current schema/code and doesn't appear in git history, so its origin is untraced on the reporter's instance, but the underlying fragility is real regardless of how the key got there.

Suggested fix

Add a cleanup migration for orphaned keys in zoekt_settings, and consider auditing other jsonb_accessor columns on ApplicationSetting for the same class of risk, so a single corrupted row can't permanently block saves.

Reproduction

Full investigation and repro steps are in the parent issue #607625 (Problem 3), and the split rationale is in this comment.