Replace an assistant's curation labels.

Here rather than on the assistant routes because labels are not the owner's to set — they exist to organise the review queue above, which filters on them. The module's router-wide gate is what enforces that.

The body is the complete set: it replaces rather than merges, so removing a label is sending the list without it. It replaces the owner's labels too — the curator has the last word on what an assistant is filed under.

Every entry must name a label in the vocabulary. Minting one is PUT /label/{label_id}, deliberately a separate act: a typo here should be a refusal, not a new label nobody meant to create.