BIZ-007 §7 — flip an enterprise lead's contact status (audited, admin-gated)

Set or clear contacted_at on one enterprise-waitlist entry.

{"contacted": true} stamps contacted_at with the SERVER clock; {"contacted": false} clears it (undo). The client never supplies a timestamp — a forged/skewed client clock can't land in the row.

Non-destructive → a plain toggle, no confirm contract. But it IS a mutation on the operator surface, so it writes an auth_audit_log row via the fail-closed _audit_or_500 wrapper (ADMIN-OPS-001 pattern): actor = admin (user_id + email), and detail carries the target id + the new boolean state ONLY — never the prospect's email (lead PII stays out of the trail). Idempotent: flipping to the current state still returns 200 (with changed=false) and still audits the deliberate action.

Pro waitlist is intentionally NOT mutable here — its notified_at has launch-notify semantics driven by a one-shot script, a different lifecycle.

Auth: anonymous → 401, non-admin → 403, admin → 200. Flag-off → 404 (rule #4). Unknown id → 404.