Update white-label configuration

Updates any of the tenant-configurable white-label fields. Unknown top-level keys are silently dropped (strong-params whitelist). Writes an account.white_label_updated audit event visible via GET /api/security_events.