Clarify settings apply/save comment; strengthen settings tests

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/web/settings_handlers_test.go

@@ -68,8 +68,12 @@ func TestPostSettingsValidAppliesAndSaves(t *testing.T) {
 	if fa.last.AIBackend != "codex" {
 		t.Errorf("applied backend = %q, want codex", fa.last.AIBackend)
 	}
-	if _, err := os.Stat(path); err != nil {
-		t.Errorf("settings file not written: %v", err)
+	saved, err := settings.Load(path)
+	if err != nil {
+		t.Fatalf("settings file not loadable: %v", err)
+	}
+	if saved.AIBackend != "codex" || saved.MarvinCmd != "uv run am" || saved.KnowledgePath != "/tmp/k.md" {
+		t.Errorf("saved settings = %+v, want codex/uv run am//tmp/k.md", saved)
 	}
 }
 
@@ -87,4 +91,22 @@ func TestPostSettingsInvalidBackendIs400AndNoSave(t *testing.T) {
 	if _, err := os.Stat(path); !os.IsNotExist(err) {
 		t.Errorf("settings file should not exist after rejected save, stat err = %v", err)
 	}
+	if fa.called != 0 {
+		t.Errorf("applier recorded %d successful applies, want 0", fa.called)
+	}
+}
+
+func TestPostSettingsInvalidJSONIs400(t *testing.T) {
+	s := newTestServer(t)
+	fa := &fakeApplier{}
+	s.SetSettings(filepath.Join(t.TempDir(), "settings.json"), settings.Settings{}, fa.apply)
+	r := s.Router()
+
+	w := post(t, r, "/settings", `{not json`)
+	if w.Code != http.StatusBadRequest {
+		t.Fatalf("status = %d, want 400", w.Code)
+	}
+	if fa.called != 0 {
+		t.Errorf("applier called on invalid json; want 0, got %d", fa.called)
+	}
 }