feat(acl): allow config|get for auditability

[tkarger]

This PR closes #335

Summary

The _operator user had only the permission to CONFIG SET, not to CONFIG GET. Due to this limitation the user wasn't able to retrieve the current configurations of the cluster and audit the state.

Features / Behaviour Changes

The _operator user can check the applied settings of the valkey instance and audit changes

Implementation

The permisson for config|get was added to the _operator user.

Testing

Tested by e2e tests

Checklist

Before submitting the PR make sure the following are checked:

• This Pull Request is related to one issue.
• Commit message explains what changed and why
• Tests are added or updated.
• Documentation files are updated.
• I have run pre-commit locally (pre-commit run --all-files or hooks on commit)

[greptile-apps]

Greptile Summary

The PR expands the _operator system user's ACL to permit read-only CONFIG GET commands for configuration verification and auditing.

Confidence Score: 5/5

The PR appears safe to merge with no actionable defects identified.

The change grants the existing privileged operator account read access to Valkey configuration while preserving the command-scoped ACL model and existing credential boundary.

T-Rex Logs

What T-Rex did

• Validated the general-contract proof by showing the before ACL for the _operator lacked +config|get, the after ACL includes both +config|set and +config|get, and the focused test passed.
• Identified that the retained harness is the exact narrow controller-generation test used for both captures.
• Cataloged the uploaded artifacts (four logs and a Go test harness) as evidence supporting the contract validation.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
internal/controller/users.go	Adds the narrowly scoped `+config

_{Reviews (1): Last reviewed commit: "feat(acl): allow config|get for auditabi..." | Re-trigger Greptile}

[jdheyburn]

Thanks for raising - I left a comment on the issue on what underlying bug we're trying to solve.

• [BUG]: ACL misconfiguration: _operator user can CONFIG SET all parameters #335 (comment)

[melancholictheory]

this one's independently correct regardless of where the broader #335 discussion lands: read-only, no new write surface, and it closes the write-without-read audit gap. it's also useful to the operator itself, the live-config apply path can read a key back after CONFIG SET to confirm it took, which the current -config|get blocks. worth landing on its own.

[jdheyburn]

Thank you!