Save Campaign Targeting Admin

Cross-org save of rule-builder wire groups.

Accepts the same wire shape the org PUT /campaigns/{id}/rules accepts, converts groups → {rule_type_key, params, sort_order} and proxies to campaign-service. The raw PUT /rules above is left untouched for callers that already send converted rows. Legacy YAML campaigns 409 here so the admin save can't persist rules the YAML engine never applies.