Accept a suggestion application and re-publish

Accept a reviewable suggestion application for an optimization and push the updated content back to the CMS destination it was originally published to. The remote post is UPDATED in place — never re-created — so the existing URL and external ID are preserved. Requires the write:content scope and a plan with content optimization.

Both content_id and application_id must be supplied and must line up with the optimization named in the path: the optimization's content must equal content_id (400 invalid_request otherwise), and the application must belong to the same organization, optimization and content (404 otherwise). The CMS destination and remote post id are read off the content row — you cannot supply them.

The application must be in reviewable state. An accepted or reverted application is 409 already_terminal; any other state is 409 invalid_state. On success the application is moved to accepted, and a content row sitting in review is moved to published.

This is an unattended caller, so drift is never forced: if the post changed in the CMS since Frase last published it, the request is refused with 409 REMOTE_CONTENT_CHANGED and must be resolved in the Frase app. Content rule violations and Trust & Safety blocks refuse with 422. A CMS integration that needs reconnecting refuses with 401 code UNAUTHORIZED (data-wrapped) - fix the connection in the Frase app. Rate limits apply on two axes — a per-user hourly generate budget (30/hour) checked before any work, and a per-organization re-publish limiter (5/minute) inside the publish path; both answer 429 with code RATE_LIMITED.

Status codes are chosen so that only genuinely retryable failures land in the 5xx range: 409, 410 and 422 refusals never self-clear and must not be retried. Every failure body except the 400 parameter errors, the 404s, and the plan-gate 403 carries a machine-readable code alongside error.

CORS preflight is supported (OPTIONS returns 204; allowed methods POST, OPTIONS; allowed headers Content-Type, X-API-KEY, token).