Replacement auth method. Same shape as in create — aws with allowlists or token with no config. Existing gateways keep working until they restart and re-authenticate via the new method.