Apply guarded FGA tuple mutations

Accepts writes and/or deletes arrays totaling at most 40 FGA tuple operations per request. Each accepted mutation is one atomic FGA Write; invalid tuples reject the entire transaction. Duplicate writes/missing deletes use bounded exact-key refresh and whole-transaction revalidation, never per-tuple retries. Creates require complete structural prerequisites; delete-only repair remains allowed. Requires a Google ID token from the configured AI Studio Terraform or runtime service account (localdev instead accepts a signed-in user's Auth0 token on loopback). Autonomous calls need no forwarded user header or service FGA grant; caller and write-scope validation apply. Writes and deletes must target objects of AI Studio's own applications or account, organization and group objects, or the dock's global application instance at platform/crisp/app-dock and its descendants (module instances, role-bundle instances and sharable entities). Dock catalog objects and its other scopes are excluded. All mutations pass through the dock authorization writer and its write guardrails. With X-User-Authorization: Bearer <user JWT>, supported grants and memberships are authorized against the verified user's Studio workspace owner with accountId and pre-write tenant boundary checks; structural and role-wiring tuples are rejected in delegated requests.