Replace the allowed sync origins

Replace the whole allow-list. An empty array means any origin may stage with the publishable key, which widens who can act — outward-facing (Tier B). Every entry must be a bare http(s) origin, so a path, query, or credential in the value is a 400. Scope: workspace:manage.