Update the org's OTLP export configuration

Every field is optional and only present fields change. The endpoint is validated and DNS-resolved on save: HTTPS only, no embedded credentials, and refused if any resolved address is private, loopback, link-local, metadata or ULA. A URL that resolves to a private address is the SSRF, and it is refused here rather than left in the database looking configured.

headers replaces the whole map when present and is encrypted at rest under the org's key. Omit it to change other fields without touching stored header values you cannot read back.

Transport is OTLP over HTTP with JSON encoding, posted to <endpoint>/v1/traces, /v1/metrics and /v1/logs. What leaves is exactly what the org's own dashboard stream carries — signals already through the collector's redaction pass.