Replace the tag set on a service account

Replaces the full key/value tag set of the service account from the editable Tags tab on the detail view (e.g. env=prod, team=platform, managed-by=alican). The UI supports adding, removing and saving tags as one atomic save, so this is a full PUT replacement: tags omitted from the request are removed. The updated tag set is immediately visible to subsequent reads of the detail view. Validation: account must exist and be visible in the scope (else 404 NOT_FOUND); each tag needs a non-empty key unique within the set, and key/value must respect the platform tag length/charset limits — violations → 422 VALIDATION_FAILED; caller must hold a write-capable role (owner|admin|contributor) else 403 FORBIDDEN. Async & state: Synchronous mutation — 200 with the persisted tag set; no transitional states. Emits one resource.updated SSE frame (kind: iam.service_account, patch: {tags}) so other open sessions refresh. Errors: 401 unauthenticated; 403 lacks write permission; 404 unknown account; 422 malformed tag keys/values or duplicate keys; 500 persistence failure. Idempotency/Concurrency: Idempotency-Key recommended — replay returns the already-applied result. This operation does not check If-Match; a sent one is ignored and the last write wins.