Apply an owner override on this desk, then return the full bans payload so the UI re-renders from one response instead of a write + refetch.

allow / block upsert the desk's single row for that IP (unique on (domain_id, ip_address)) and clear any expires_at — re-deciding an IP means the new decision is open-ended until someone says otherwise. clear deletes the row, dropping the IP back to the derived threshold behavior. A block on a protected AI-provider address is refused (422): the address is shared by everyone using that assistant.