Operator: suspend a workspace

Operator console only: requires the web session of an address in the operator allowlist of this installation, sent from the application itself. Every other signed-in caller and every valid Bearer token receives 404 NOT_FOUND, whether or not this installation has an operator configured; a caller with no valid credential receives 401, as on every route. Recorded in the operator log. Every board role in the workspace reads as viewer and new checkouts are refused; reading, export, people, the billing portal and deletion stay open. Billing is not touched. 409 when already suspended. The body gives the reason, from a closed list; noticeSentOn, the day the owner was written to — between 90 days before today and the day after it in UTC (400 otherwise) — or null when there was no prior notice; and confirmSlug, the workspace’s slug (400 when it is another). It may give reviewOn, the day to look at the suspension again — it lifts nothing — between today and 90 days ahead in UTC (400 otherwise), 14 days ahead when omitted; and a reference: a ticket or card key, never an address.