Replace the caller's own spending policy wholesale

Only an account nobody governs may set its own policy (the root of its own chain, including a self-owned root agent, with no governance mandate from someone else); an agent can never lift a freeze on itself (403, an admin does); a delegate agent's budget is its owner's to grant (PUT /api/v1/agents/{id}/spending_policy) and is refused 403. Once set, transfers#create enforces it on mainnet sends exactly as it does for an agent.