Replace the tag set of a VM snapshot

Replaces the full key/value tag set of the selected VM snapshot with the submitted set, as driven by the editable Tags tab of the VM snapshot detail page (the panel supports adding, removing and saving tags as one atomic save). This is a full-replacement PUT: tags absent from the request are removed, new keys are added, and changed values are overwritten. The resulting tag set is immediately visible to subsequent reads and to Cost Explorer dimensions. Validation: the snapshot must exist in the scope and not be soft-deleted (404 NOT_FOUND) and its current state must permit tag updates; the body must be an array of {key, value} pairs with non-empty unique keys — duplicate keys, empty keys or malformed entries map to 422 VALIDATION_ERROR; the caller needs contributor/admin/owner rights on the scope (403 FORBIDDEN). Async & state: Synchronous (200). The tag set is persisted atomically and the canonical resulting tag list is returned; a resource.updated SSE frame is emitted for the snapshot with a patch on tags. The snapshot status is unchanged. Errors: 401 unauthenticated; 403 insufficient role; 404 unknown snapshot; 412 stale If-Match ETag (concurrent edit of the tag panel); 422 invalid tag entries; 500 internal failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. The PUT is a full replacement: a repeated identical request writes the same tag set again (same end state) and bumps version/updatedAt, returning a new ETag, so a retry that resends the If-Match read before a successful first attempt gets 412. If-Match with the snapshot's current ETag is used for optimistic concurrency; a mismatch returns 412 PRECONDITION_FAILED and the UI reloads the latest tag set before retrying.