Bulk-upsert per-org metric enablement (one row per metric_id).

Only OPTIONAL standard metrics are toggleable (the library add/remove flow); always-on standards (core/system/red-team) and custom metrics are rejected.

Org-admin only. metric_settings is deliberately organization-level: it is not one of the stamped tables, so a change here rewrites how EVERY workspace's conversations are graded, including the judge override prompts. Gated only by authentication, any member of any workspace, or a workspace-pinned API key, could silently change another team's eval results. The same gate workspace budgets use.