Update Finding Settings

Applied as one atomic write, so an admin changing several types either lands all of them or none. Empty is valid: a never-configured tenant's "accept the defaults" save has nothing to diff, and the empty write still creates the settings row.

The full catalog after the write, in the same shape ListFindingSettings returns.