#2547 config save follows a symlinked run config and writes its target (#2256)

Descripción

Fixes #2256. Based on the patch @adolfotregosa attached to the issue (credited as co-author); the code change is
theirs, the tests are rewritten so the web-page test is its own method.

**What it changes.** In the container the server starts from `/opt/strata/strata-<model>.json`, a symlink into the
data volume (`docker-entrypoint.sh`, #1244). The web page's Model settings save (`serve/runconfig.save`) and setup's
`write_config` wrote a temporary file and `os.replace`d it over the path, which replaced the link with a regular
file inside the image: the page said saved, the volume's file never changed, and a recreated container lost the
edit. Both now follow a symlink and write its target (`runconfig.save` keeps `<name>.bak` next to the target), and
the link stays a link.

**What it leaves alone.**
- A run config that is a plain file (every install outside the container): written exactly as before (the change is
  behind `path.is_symlink()`).
- `setup.write_config` on a link into a folder that no longer exists replaces the link with a file, as before (it
  follows only a link whose target's folder exists), so a setup run never fails where it used to succeed.
- `docker-entrypoint.sh` is unchanged. After `setup.py --setup` it runs `cmp -s link cfg || cp -f link cfg`; with the
  link kept and pointing at `$cfg`, `cmp` finds the same file and `cp` does not run.
- One behaviour that does change on purpose: a link whose target cannot be replaced (a read-only or single-file bind
  mount given as `CONFIG=`) now makes the save fail with the server's existing "the run config cannot be written"
  message, where before the edit silently went into the image layer.

**How it was checked.**
- `serve/test_runconfig.py` `Http.test_the_container_symlink_is_written_through_2256`: the config is a link into a
  "volume" folder; a POST /config from the page writes the target, keeps the link, and leaves the `.bak` beside the
  target. Fails on `main` (the target keeps temperature 0.7).
- `tools/test_setup_risk.py` `BrokenEarlierConfig.test_write_config_follows_the_container_symlink_2256`: the same
  for `write_config`, plus a link into a missing folder (replaced by a file, as before). Fails on `main`.
- `python3 -m unittest serve.test_runconfig serve.test_security`: OK. `python3 tools/test_setup_risk.py`: OK.
- Python 3.14, Ubuntu (Linux 7.0); no GPU needed. Not run inside the Docker image.

🤖 Generated with [Claude Code](https://claude.com/claude-code)