Replacement auth method. Same shape as in create: aws with allowlists, kubernetes with cluster config, or token with no config. Existing gateways keep working until they restart and re-authenticate via the new method.