Put User Custom Providers

Whole-list replace of the user's custom provider definitions (last-writer-wins). Accepts either a bare list or {providers: [...]}. Rejects any payload carrying a secret-looking field.