Set the tenant-wide default, enabled included.

This is the kill switch. Turning enforcement off is this same PUT with enabled: false — no deploy, no revert, and it bites immediately because the write invalidates every cached context on the way out.

Reach it from a browser during a Redis outage, not with an API key. Enforcement runs in get_current_user for anything carrying X-API-Key, before any handler, so with the shared counter unreachable the owner's own key is refused here exactly like everywhere else. Session traffic never touches the limiter, so a signed-in browser reaches this endpoint throughout. That is the documented way out, and it is why the limiter is not also gated behind a credential that a Redis outage can take away.