Set tenant status

Sets the operational status of the tenant. The Service Orchestrator's S3 gateway must enforce these states:

• active — read/write access.
• write-locked — read-only; uploads and bucket creation blocked, but reads, listings, and deletes succeed.
• disabled — all access blocked. Data is persisted and recoverable by transitioning back to active.

Setting the same status twice is a no-op (still returns 204).