Replace the hostname lists

Owner or admin only; replaces the whole list. Unlike the dashboard equivalent this answers 400/500 on a bad body or a failed write instead of 200 with success:false — a status-checking client must not read a failure as done. Refused with 409 site_domain_blocked when the lists would block the site's own domain while that domain is sending events (last 7 days): saved, such a list would silently drop all of the site's traffic. Nothing is written.