Applies opt-out or opt-in for up to 1000 recipients in a single request. Each entry is keyed by phone_number OR (external_id + source_system) and processed independently for expected identity errors. Infrastructure failures return a retryable HTTP 500. Applies are idempotent.