Set brand name, connect-link return URLs and the REST policy

Two groups, each behind its own capability (GET /account enterprise). Connect settings (enterprise.linkedinConnect): where end users land after a hosted LinkedIn connect link resolves, and the white-label name shown on that page (1-60 characters; null uses your workspace name). An absent field is kept, null or "" clears it. The end user id and link id are appended to the redirect as externalUserId and connectLinkId; only expired or revoked links use the failure URL. REST policy (enterprise.outreach): requireUserHeader true makes every /api/v1 request with this key that lacks X-PumpGTM-User fail with 400 user_header_required, so a missing header can never act on your own workspace; /api/partner/v1 and the per-user MCP URL are unaffected. Nothing is written when any group is refused. 400 { error, field } on a bad value (invalid_url, https_required, host_not_allowed, url_too_long, invalid_brand_name, invalid_require_user_header); 400 nothing_to_update or invalid_body with field null; 403 enterprise_required when the needed capability is off.