feat(users): add PUT /users/:id with validation and 404 handling

Full-replace semantics: name and email are both required as non-empty
strings and the email is shape-checked, so a partial body is a 400 rather
than a silent half-update. The body is validated before the store lookup
because a malformed request is a client error either way.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Vlad-Skrekoten

routes/users.js

@@ -3,6 +3,14 @@ const store = require("../db/store");
 
 const router = express.Router();
 
+// Deliberately loose: enough to catch obvious typos without pretending to
+// implement full RFC 5322 validation.
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+
+function isNonEmptyString(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+
 // GET /users — list every user
 router.get("/", (req, res) => {
   res.json(store.getAllUsers());
@@ -32,4 +40,31 @@ router.post("/", (req, res) => {
   res.status(201).json(user);
 });
 
+// PUT /users/:id — replace a user's details; name and email are both required
+router.put("/:id", (req, res) => {
+  const id = Number(req.params.id);
+
+  if (!Number.isInteger(id)) {
+    return res.status(400).json({ error: "id must be an integer" });
+  }
+
+  const { name, email } = req.body;
+
+  if (!isNonEmptyString(name) || !isNonEmptyString(email)) {
+    return res.status(400).json({ error: "name and email are required" });
+  }
+
+  if (!EMAIL_PATTERN.test(email.trim())) {
+    return res.status(400).json({ error: "email must be a valid email address" });
+  }
+
+  const user = store.updateUser(id, { name: name.trim(), email: email.trim() });
+
+  if (!user) {
+    return res.status(404).json({ error: "User not found" });
+  }
+
+  res.json(user);
+});
+
 module.exports = router;