Activate WAF on upgraded instances

[kriszyp]

Summary

Adds waf to the safe list of newly introduced built-in component keys that are restored on in-place upgrades. This gives upgraded Harper Pro 5.2 instances the same WAF activation behavior as fresh installs while preserving explicit waf: false configuration.

The focused backfill test covers registration-gated activation and the persisted empty WAF config block. General WAF documentation is already covered by docs: add Web Application Firewall reference.

Generated by Codex (GPT-5).

[gemini-code-assist]

Code Review

This pull request adds the waf component to the list of built-in keys that are backfilled during upgrades (UPGRADE_BACKFILL_BUILTIN_KEYS) in config/configUtils.ts. It also updates the documentation comment to reflect this addition and introduces a corresponding unit test in unitTests/config/configUtils.test.js to verify that the waf configuration is backfilled correctly when missing. No review comments were provided, and there is no feedback to address.

[claude]

Reviewed; no blockers found.

[Ethan-Arrowood]

LGTM. Enrolling waf into the existing secretCustody upgrade-backfill is a clean, low-risk reuse — the empty waf: {} default is genuinely pass-through (rules are table-driven, the matcher starts null, and a no-match falls through to the next handler), so activating it on unconfigured upgraded instances is a no-op at the request path. Idempotent and fresh/upgrade parity holds.

One question before this lands: since this auto-activates the WAF on every upgraded instance, should it get a 5.2 release-note entry? It's a behavior change on upgrade even though it's pass-through by default, and I'd lean toward calling it out so operators know the component is now present.

_{sent with Claude Opus 4.8}