Operator: lift the suspension of a workspace

Operator console only: requires the web session of an address in the operator allowlist of this installation, sent from the application itself. Every other signed-in caller and every valid Bearer token receives 404 NOT_FOUND, whether or not this installation has an operator configured; a caller with no valid credential receives 401, as on every route. Recorded in the operator log. The workspace is writable again, unless its billing state makes it read-only too. Billing is not touched. The body is a JSON object, empty at least, and may give a reference: a ticket or card key, never an address. A workspace that is not suspended answers 404.