Restrict a carrier on a specific lane
Mark this carrier as ineligible for the specified lane. Requires a human-readable reason; an audit-log row capturing the actor, reason, and timestamp is written in the same transaction. Idempotent: calling this endpoint when the preference is already restricted returns the current row unchanged and writes no audit entry. Admin-only — requires OWNER or ADMIN role on the organization.
**Authentication:** Bearer token required.

