Flatten share/API config keys, nest validation limits only, and move the HTTP client to plugins/axios.