Operator: reject an agent’s proposal

Operator console only: requires the web session of an address in the operator allowlist of this installation, sent from the application itself. Every other signed-in caller and every valid Bearer token receives 404 NOT_FOUND, whether or not this installation has an operator configured; a caller with no valid credential receives 401, as on every route. Recorded in the operator log. Writes the proposal alone: nothing it names is done. The body may give a note, up to 500 characters. 404 for a proposal that does not exist; 409 when it is already decided or expired.