Set Rooster Browser Anti Bot

Frederick, 2026-09-24: "only the owner ... can turn on" (default later moved to ON, the gate did not -- see migration 0619's own comment). ANTI_BOT_MANAGE_KEY is system:browser_anti_bot:manage, seeded to Frederick's principal alone; the route gate is the grantable system:credentials:write, and anyone without the owner key gets 403 from the check below before anything is written. settings_service.upsert_setting records who and when (updated_by/updated_at) and emits the same outbox audit event every other setting change already does -- no second audit mechanism needed here.