Replace a mailbox's access

Replaces the whole access list of one mailbox address, or of a domain (@example.com or the bare domain). Needs delegations:manage: a dashboard session, the person's own Primitive CLI, or an org-wide API key, which acts for the person it belongs to and works only while that person is still an owner or admin holding the permission. Any other OAuth app answers step_up_required until the person confirms in the dashboard and the request carries the Primitive-Step-Up header. Narrowed, Function and connected keys are refused. Nobody grants access beyond their own (rule 1): each added or widened entry must be within the caller's own mail access and permissions; an API key never gives access to a member's personal mailbox. Every change is recorded in the credential audit log.