Persist the tenant's tunnel plugin overrides (Settings → Tunnel Plugins).

Accepts {"config": <overrides>} or a bare overrides dict/list. The config is normalized before storage; an empty result clears overrides (NULL → the built-in defaults).

Every write bumps the tenant/hostname-scoped runtime configuration generation (02dbd8b4) and reports back whether it is safe to treat as already-applied or whether a running tunnel needs a restart to pick it up — see config_generation in the response. A no-op save (identical effective config) does not advance the generation or flag a restart.