disallow to disable guard during focus

backend/app/api/routes_settings.py

@@ -38,13 +38,20 @@ def put_settings(session: DbSession, patch: dict[str, Any] = Body(...)) -> dict:
         # `exc.errors()` can carry exception objects in `ctx`, which JSON cannot
         # take; pydantic's own `json()` renders them as text.
         raise HTTPException(status_code=422, detail=json.loads(exc.json())) from exc
+    except blocker_service.GuardLocked as exc:
+        # 409, not 422: the body is valid, the current state refuses it. A plain
+        # string detail is what every client's error path already surfaces.
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
     return {"settings": settings_service.mask_secrets(updated.model_dump(mode="json"))}
 
 
 @router.post("/reset")
 def reset_settings(session: DbSession) -> dict:
     """Back to defaults, re-seeded from the environment."""
-    updated = settings_service.save_settings(session, settings_service.settings_from_env())
+    try:
+        updated = settings_service.reset_to_env(session)
+    except blocker_service.GuardLocked as exc:
+        raise HTTPException(status_code=409, detail=str(exc)) from exc
     return {"settings": settings_service.mask_secrets(updated.model_dump(mode="json"))}