Can I allow setup editing while preventing authentication from being changed

Yes, by using section permissions

Section permissions first need to be turned on at the top level of the Authentication section

Then a role can be created that uses the 'sections' permission, allowing everything except the authentication section.  This applies across all files that the users with this role are able to edit.

Note: This setting is different from 'Restricted sections' which is a top level item (rather than being under Authentication) and applies to all users on a per file basis - allowing include files to be limited to a particular purpose.