GET /accounts/me/l1-categories (require_l1_or_above) returns enabled + available + hard_floor; PATCH (require_account_owner_or_admin) sets the enabled set, dropping unknown/hard-floored keys via l1_category_service. New L1CategoriesResponse/Update schemas. 6 API tests green (incl. engineer + l1_tech write both 403); test_accounts regression 36 passed. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>