Atomically sets the allowsTenantOverride flag on the three active tenant
policy rows (algorithm / rotation / lifecycle) for the given tenant. The
mutation runs inside a single @Transactional boundary; JPA @Version
optimistic-lock guards detect concurrent modifications and emit HTTP 409.

Required scope: admin.tenant.policy.override.toggle (platform-tenant
principal only — non-platform JWTs that happen to carry the scope are
rejected with 403 by validatePlatformAccess()).

Lock-state guarantee: when the deployment is LOCKED (any deployment
policy has is_immutable=true), this endpoint returns HTTP 409 with the
documented RFC 7807 body BEFORE any tenant lookup is performed. This makes
the LOCKED contract a global invariant of the endpoint — callers cannot
disambiguate known/unknown tenants by observing 409-vs-other responses.

Root tenant immutability: attempts to target the root platform tenant
are rejected with 403 before the lock-state check is consulted.