Update Card Positions

Persist the Groups & Experiments grid layout for one hotel.

Writes position and NOTHING else. Experiment config (daily scan, samples, model selection) stays on PUT /experiments/{id}: dragging a card is a much lighter action than reconfiguring an experiment, and layout must not widen the write surface on those columns.

The layout is shared by every user of the tenant, scoped to this hotel — the same model Reporting uses for Widget.position.

MANAGE_SETTINGS costs nothing in reach here: the Groups & Experiments page is already gated on MANAGE_SETTINGS (the Visibility Lab area gate), so a viewer without it never renders a card to drag in the first place. This gate is the server-side half of that same rule, not a second, stricter one. (Reporting authorizes layout with a per-tab ACL — can_edit = admin OR access_row.can_edit — so an admin there can grant a named member edit access. AI Presence has no grant mechanism and the tenant permission model is roles-only, but that difference only becomes visible if the page-level gate is ever relaxed.)

Every id is validated against this hotel BEFORE anything is written, so a request naming a foreign card changes nothing at all rather than applying partially.