Super-admin endpoint. Edits user-specific permissions (upsert) for a project, enforcing global locks.

Expected body: { "role": "photographer", "user_id": "user_target", "changes": { "sharelinks.create": true, "images.delete": false } }