Send a set_active_repo control message to the tenant's extract WebSocket.

The tunnel client's _run_extract_pool_connection handles this message and updates SerenaPool.default_repo_path at runtime — no tunnel restart needed. Returns 503 when no extract tunnel is connected, 404 when auth fails.

46fd16f1 — delegates to :func:send_active_repo_control instead of sending the WebSocket message itself, so this HTTP entry point ALSO updates _tenant_active_repo (previously it only pushed the WS control message, leaving the server-side cache stale — a worktree-scoped caller that switched repos through this REST endpoint would see subsequent call_tunnel_tool calls without an explicit repo_path [e.g. prospect_symbol's Serena rung] keep routing to whatever repo was active BEFORE this call, silently querying the wrong checkout).