Add or replace an authorized client

Tor v3 restricted discovery: submit a locally generated X25519 public key (base32, 52 chars), or generate: true to have one minted — the private key is returned ONCE and never stored. Every client-list change restarts the host's shared Tor daemon briefly (invalidating existing rendezvous state is the point); onion connections for other apps on the same server may blip while containers keep running. Revoking the last client makes the service public again. Requires the manage scope and an agent announcing onion-auth-v1.