Release 1.14.0

openvibe-shared/config, the configuration model (roadmap WS-C task 7): createConfigStore({ db, service, namespace, schema, validate, classify, defaults, legacy, onActivate }) keeps one namespace of a service's configuration as immutable revisions (common.config-snapshot@1) in the service's own better-sqlite3 database (config_snapshots; several namespaces per database). get() serves the active values from memory; propose/activate/apply validate (a built-in JSON Schema subset and/or validate()), classify every key (public, internal by default, secret) and activate in one transaction, and a throwing onActivate puts the last-known-good back in memory and in the database, rejects the new revision with the error and throws it. rollback() activates a copy of the previous good revision (or to) as a new revision; history(), lastKnownGood() and summary() are redacted: a secret is { redacted: true, fingerprint }, an HMAC-SHA256 under a random 32-byte key made per namespace on first use (config_keys; never served, never logged), a snapshot's checksum covers the values as shown, and secret values never leave or reach the log. A marker sent back keeps the secret it stands for only when its fingerprint matches. Revision 1 comes from defaults or a legacy source (legacy, import(), fromRows() for typed key-value rows). adminRoutes(stores, { requireAdmin }) serves GET /api/admin/config, GET /api/admin/config/:namespace/history, POST /api/admin/config/:namespace and POST /api/admin/config/:namespace/rollback with problem+json errors, on Express or plain http, without depending on either. No new dependency. Additive.