Update Project Locked Tags Endpoint

Replaces the project's locked tags with the body's list. Body: { projectId: number, lockedTags: string[] }.

Gated on 'settings.manage.lockedTags' (migration 026). Before that this endpoint was gated only by require_project_access, so ANY project member — a photographer included — could rewrite the locked-tag list and expose images the organizers had deliberately withheld. require_task_or_403 also enforces project membership, so it replaces that check.