Source configuration versioned in code

Scraper configurations stored only in the database — targets, rate limits, user-agent strings — can be changed by anyone with database access, bypassing code review and leaving no audit trail. SLSA Build L2 and SSDF PW.4 both require that build and configuration artifacts go through version control. A silent config change that removes rate-limit constraints or adds a scraping-prohibited domain is a legal and operational risk that version control would have caught.

Move base source configuration to a code file in src/config/ so that changes require a pull request and deploy. Dynamic overrides (pause flags, temporary rate-limit adjustments) can remain in the database as long as the canonical configuration lives in code.

// src/config/sources.ts
export const SCRAPER_SOURCES = [
  {
    id: 'linkedin-search',
    baseUrl: 'https://linkedin.com/search',
    rateLimitMs: 2000,
    robotsTxtEnforced: true,
    legalBasis: 'legitimate_interest',
  },
] as const

Load this array at startup and merge with any database overrides; the code definition always wins for security-sensitive fields like robotsTxtEnforced.