Fetching live runtime status and metrics.
Three-tier scan/governance controls with guarded admin write path.
No payload returned from `/api/v3/aapf/config`.