Replace metric guards for a check

Replaces the complete set of metric guards for the check (replace-the-set semantics) — the request body is the new set in its entirety; guards absent from the body are deleted.

Every guard is validated before any write (the same validation everywhere): a missing name, a path containing [, * or $, an aggregation outside sum/max/avg, a window_s of zero or below, a window_s above 604800, or a non-finite ceiling all fail the request with 400 and nothing is written. The 400 message names the offending guard.

Two caps apply, and both are measured cost rather than taste:

• window_s at most 604800 seconds (7 days). A guard re-reads every ping body in its window on every ping, so the work grows with the window. Seven days is also comfortably inside the 90-day ping retention, past which a guard would aggregate over pings no longer kept and quietly under-report.
• At most 5 guards per check, against 20 for assertions. An assertion is a string match over a set already in hand; a guard is its own lookup, because each carries its own window — so N guards multiply the per-ping cost by N.

Returns the resulting set (same shape as GET) on success.