Enable or disable Content Guard monitoring

Enable or disable Content Guard monitoring. Enabling needs an address Guard can watch, resolved by a recovery ladder: the stored URL when absolute; otherwise (empty slot, non-FraseCMS) the newest live CMS-inventory URL (persisted when absolute); otherwise, for a FraseCMS article with a live published post and a configured domain, an address re-derived from the site's CURRENT settings (persisted). A relative stored URL is therefore NOT a refusal by itself — a FraseCMS article published before domain setup becomes armable the moment setup finishes, with no re-publish. Refusals: NO_PUBLISHED_URL when the slot is empty and nothing was recoverable (note this can include a published article whose publish stored no URL); UNUSABLE_PUBLISHED_URL when a stored value exists but no ladder leg produced an absolute address. Enabling is quota-checked against the plan's monitored-articles limit; disabling never needs a URL. A no-op re-assert of the current state still returns 200 and does not rewrite monitoredAt. A successful enable can carry a warning (e.g. the initial reachability probe failed) without failing the request.