Set per-user visibility overrides in bulk

Applies many visibility overrides for the calling user in a single transaction — hidden=true stores an override, hidden=false removes it. Use this rather than issuing one PUT per object: hiding a large map one request at a time saturates the browser's connection pool, and a partial failure leaves the map half-hidden. All changes apply or none do. Requires only viewer permission on the map.