Replace the organization’s proof-of-address policy

Replaces the stored policy wholesale — send the complete settings object, not a patch. Accepts either the settings object directly or {"settings": {...}}.

Validation is shared with the workflow node config, so the two can never diverge: unknown keys are dropped, unknown document types are rejected, recency windows must be 1–365 days, thresholds must be between 0 and 1, and each *_match_review threshold must be less than or equal to its *_match_pass counterpart. Every problem is reported at once in the 422 detail.

Requires the manage_settings permission and the proof_of_address_check feature. Writes a settings.proof_of_address.update audit log entry.