docs: document the config MQTT channel and HTTP routes

Add the config channel to the MQTT topic reference (category table,
telemetry data table, and a new Configuration section with a worked
example), and the two GET /te/v1/entities/<service>/config[/<key>] routes
to the entity HTTP API reference, cross-linked with each other.

Signed-off-by: Albin Suresh <albin.suresh@cumulocity.com>

Author: albinsuresh

docs/src/operate/entity-management/rest_api.md

@@ -488,6 +488,69 @@ Remove all of the child device's twin data using a single request.
 curl -f -X DELETE http://localhost:8000/te/v1/entities/device/child01///twin
 ```
 
+## Get exposed configuration
+
+Each entity that owns `tedge_config` settings (e.g. `tedge-agent`, or a cloud mapper such as
+`tedge-mapper-c8y`) publishes any setting explicitly marked exposable as a retained `config` MQTT
+message under its own service topic (see the [MQTT API reference](../../references/mqtt-api.md#configuration)).
+The agent collects these as an ordinary MQTT subscriber and serves them as a read-only view over HTTP.
+
+This view is read-only: `PUT`, `PATCH`, and `DELETE` on a `config` resource path are rejected.
+Configuration can only be changed by its owning component, via `tedge config set` and a restart.
+
+A configuration key that is not marked exposable and a key that does not exist at all are
+indistinguishable here: both return `404 Not Found`, so the response reveals nothing about which
+non-exposed settings exist.
+
+### Get a single configuration value
+
+**Endpoint**
+
+```
+GET /te/v1/entities/{topic-id}/config/{key}
+```
+
+**Response status codes**
+
+* 200: OK
+* 404: Not Found (the key is not exposed, or does not exist)
+
+#### Example: Get the agent's device.id setting
+
+```sh
+curl http://localhost:8000/te/v1/entities/device/main/service/tedge-agent/config/device.id
+```
+
+```text title="Response"
+my-device-01
+```
+
+### Get all exposed configuration
+
+**Endpoint**
+
+```
+GET /te/v1/entities/{topic-id}/config
+```
+
+**Response status codes**
+
+* 200: OK
+* 404: Not Found
+
+#### Example: Get all of a c8y mapper's exposed configuration
+
+```sh
+curl http://localhost:8000/te/v1/entities/device/main/service/tedge-mapper-c8y/config
+```
+
+```json title="Response"
+{
+    "url": "example.cumulocity.com",
+    "device.id": "my-device-01"
+}
+```
+
 ## Query entities
 
 Get a list of entities which match given filter criteria.

docs/src/references/mqtt-api.md

@@ -246,6 +246,7 @@ The following is an overview of the channel categories which are available.
 | a        | Alarms               |
 | cmd      | Commands             |
 | twin     | Entity twin metadata |
+| config   | Exposed configuration values |
 | status   | Service status       |
 | signal   | Signals              |
 
@@ -436,6 +437,7 @@ so that it can process them.
 | Events        | `te/<identifier>/e/<event-type>`       |
 | Alarms        | `te/<identifier>/a/<alarm-type>`       |
 | Twin          | `te/<identifier>/twin/<data-type>`     |
+| Configuration | `te/<identifier>/config/<key>`         |
 | Status        | `te/<identifier>/status/<target-type>` |
 
 ### Examples: With default device/service topic semantics
@@ -560,6 +562,35 @@ te/device/main///twin/device_OS
 }
 ```
 
+## Configuration
+
+A service that owns a `tedge_config` setting (`tedge-agent` for core/device settings, each cloud
+mapper for its own cloud's settings) publishes any setting explicitly marked exposable as a retained
+`config` message under its own service topic, one message per value:
+
+```text
+te/<service-identifier>/config/<key>
+```
+
+`<key>` is the setting's `tedge config` key, kept as a single topic segment (not split on its `.`s), so
+it maps directly back to a `tedge config get <key>` invocation. A mapper strips its own cloud (and
+profile) qualifier from the key, since the service topic already scopes it: `c8y.url` is published as
+`url` under `.../service/tedge-mapper-c8y/config/url`.
+
+```text title="Topic (retain=true)"
+te/device/main/service/tedge-agent/config/device.id
+```
+
+```text title="Payload"
+my-device-01
+```
+
+An empty payload means the value is unset, or was removed from configuration since the last time the
+owning service started. A setting is only published this way if it was explicitly marked exposable
+where it is defined; unmarked settings, including any secret (a private key, a PIN, a credential file
+path), are never published. See the [Entity Store REST API](../operate/entity-management/rest_api.md)
+for a read-only HTTP view of the same values.
+
 ## Commands
 
 The topic scheme for commands can be visualized using the diagram below.

openspec/changes/expose-tedge-configs/tasks.md

@@ -61,5 +61,5 @@
 
 ## 10. Documentation
 
-- [ ] 10.1 Document the `config` MQTT channel in the MQTT topic reference
-- [ ] 10.2 Document the two `config` HTTP routes in the entity HTTP API reference
+- [x] 10.1 Document the `config` MQTT channel in the MQTT topic reference
+- [x] 10.2 Document the two `config` HTTP routes in the entity HTTP API reference