Replace the organization’s proof-of-address policy

Replaces the stored policy wholesale — send the complete settings object, not a patch. Accepts either the settings object directly or `{"settings": {...}}`. Validation is shared with the workflow node config, so the two can never diverge: unknown keys are dropped, unknown document types are rejected, recency windows must be 1–365 days, thresholds must be between 0 and 1, and each `*_match_review` threshold must be less than or equal to its `*_match_pass` counterpart. Every problem is reported at once in the `422` detail. Requires the `manage_settings` permission and the `proof_of_address_check` feature. Writes a `settings.proof_of_address.update` audit log entry.