SaaS trims leading whitespace in action and per-user entries before matching, so headscale does too. Reject negative checkPeriod with "must be a positive duration" matching SaaS body. The 168h upper bound is inclusive.