Document validation key for Edge App settings

docs/EdgeApps.md

@@ -486,11 +486,12 @@ Edge App settings support additional input field types beyond plain text and pas
 
 - **Schema**: The JSON must include `schema_version` and a `properties` object.
 - **Common keys**:
-  - `properties.type`: One of `datetime`, `number`, `select`, `boolean`, `textarea`, `url`.
+  - `properties.type`: One of `string`, `datetime`, `number`, `select`, `boolean`, `textarea`, `url`. `string` is the default plain text input and can be omitted.
   - `properties.help_text`: Human-friendly description shown in the UI.
   - `properties.options` (only for `select`): Array of `{ label, value }` options.
   - `properties.display_order`: Optional integer controlling the order settings render in the install/edit UI (ascending). If omitted, `screenly edge-app deploy` auto-assigns one from the setting's position in the manifest's `settings:` mapping, so settings render in declaration order by default. Set an explicit value only to override that default. An explicitly authored `display_order` is never overwritten by the automatic assignment. Note that `deploy` only sends the computed order to the backend; it never rewrites your manifest file.
   - `properties.depends_on`: Optional `{ setting, values }` object that makes this field's visibility depend on another setting's current value. The field only renders (and is submitted) while `setting`'s current value is one of `values`, otherwise it's hidden and skipped. A malformed or stale reference (a typo in `setting`, or a setting later renamed or removed) fails open, so the field stays visible rather than disappearing. A field with `depends_on` can still be marked `optional: false`; its required-ness is only enforced while the field is visible, and is skipped along with the rest of validation while it's hidden.
+  - `properties.validation`: Optional regex the value must match, checked by the dashboard on blur and on save. Patterns are implicitly anchored to a full match (`[A-Z]{3}` matches only exactly three uppercase letters). Empty values skip this check when the field is optional; otherwise the required check takes precedence. Silently ignored on `select`/`boolean` fields, and never checked by the CLI or API, so unsupported types and malformed patterns alike deploy cleanly and surface only in the dashboard. Treat setting values as untrusted input regardless.
 - **Storage**: Use `type: string` for all non-secret fields; use `type: secret` for password-like fields. The UI will coerce values appropriately (e.g., booleans) but values are stored as strings unless `type: secret`.
 - **Defaults**: Provide `default_value` at the setting level. For booleans, use `'true'` or `'false'` as strings.
 
@@ -596,6 +597,22 @@ settings:
         type: url
 ```
 
+**Pattern validation**
+
+```yaml
+settings:
+  airport_code:
+    type: string
+    title: Airport Code
+    optional: false
+    help_text:
+      schema_version: 1
+      properties:
+        type: string
+        help_text: "IATA code for the departure board. Three uppercase letters, like LHR."
+        validation: '[A-Z]{3}'
+```
+
 **Explicit display order override**
 
 ```yaml