Configure persistent Mac authorization [admin]

Requires the owner's unrestricted account-wide personal admin key, including for reads. Team/workspace-fixed, task, app, system and restricted credentials are refused. This goes through a dedicated owner-administration path, not ordinary task or mount grants. The Mac must be online and updated. Pass only fields to change, the expectedRevision from a fresh read and a stable request_id reused on retries. Revision conflicts require re-reading; no blind overwrites. Host tools, destinations, folder roots and device authorities are validated by the same native Settings owner. OS grants remain separate.