Upsert the tenant's source-adapter mode selector

Creates or updates the per-tenant source mode selector. Both mode enums are validated server-side; provider IDs are optional and cleared when null. The Back-Office client secret is WRITE-ONLY here (accepted, never returned) and an omitted key always leaves the stored value alone; `bo_client_secret_clear` is the only way to remove it. ANY change to the Back-Office connection — `bo_mode`, `bo_base_url`, `bo_client_key`, `bo_client_secret`, or `bo_client_secret_clear` — requires a fresh step-up re-authentication (charter D10 / RFC 9470) on top of recon.setting.write; a request that changes none of them is never challenged.

curl -X PUT "https://example.com/api/recon/v1/source-config" \  -H "Content-Type: application/json" \  -d '{    "transaction_source": "external_api",    "settlement_source": "manual_upload",    "transaction_provider_id": "0190b5c2-1a2b-7c3d-8e4f-5a6b7c8d9e0f",    "settlement_provider_id": null  }'

{
  "transaction_source": "external_api",
  "settlement_source": "manual_upload",
  "transaction_provider_id": "0190b5c2-1a2b-7c3d-8e4f-5a6b7c8d9e0f",
  "settlement_provider_id": null,
  "bo_mode": "live",
  "bo_base_url": "https://connect.cashup.id",
  "bo_client_key": "ck_live_9f3a",
  "has_client_secret": true,
  "updated_at": "2026-07-20T09:05:00.000Z"
}

{
  "error": "step_up_required",
  "message": "fresh step-up authentication required",
  "request_id": "req_01"
}