### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

On a DB backed proxy removing `user_url_allowed_hosts` or the other SSRF keys from the stored config doesn't take effect until restart. The sync only applies keys it finds and never unsets anything meaning a host you removed from the allowlist still stays allowed.

Discovered that writing an explicit empty value does apply correctly within one sync poll and it's only deleting the key or the row that goes stale so there's a workaround today but the behaviour is still surprising for a security control.

This affects both `general_settings` and `litellm_settings` and was found during review on #35478 which confirmed there as a pre existing gap (https://github.com/BerriAI/litellm/pull/35478#discussion_r3696458090)

A plain reset to defaults would wipe yaml configured values so the fix probably needs to fall back to what the yaml set at start up. It would also need to only reconcile after a successful DB read otherwise a transient DB error could wipe an operators restrictions mid flight.

Happy to pick this up if that approach sounds right but open…