Add PUT /users/:id endpoint for updating a user

[MishaLehotskyi]

What changed

Adds the 'update a user' endpoint to the users resource.

• db/store.js — new updateUser(id, { name, email }). It reuses getUserById, returns undefined when no user has that id, and otherwise updates the record and returns it.
• routes/users.js — new PUT /users/:id. Validates the body, then goes through the store for the lookup and update.
  • 200 with the updated user on success
  • 400 { error: "name and email are required" } when name or email is missing, blank, or not a string
  • 404 { error: "User not found" } when no user has that id
• NOTES.md — the write-up the project asks for (plan, model choice, commit split, review).

Why

tests/update-user.test.js was already in the repo and red. This makes it green without touching the tests.

Two judgement calls worth a reviewer's attention:

• Validation runs before the lookup, so a malformed body on a nonexistent id returns 400 rather than 404. Either order passes the tests; reporting the bad request felt more useful than reporting the missing resource.
• Validation is stricter than POST /users. The existing create route uses a truthy check, which accepts { "name": 42 }. The new route uses an isNonEmptyString helper instead. I deliberately did not change POST to match — that would alter the behaviour of an endpoint this change isn't about. Worth a follow-up.

What to test

npm test is green (9/9) and npm run lint is clean. Beyond the provided tests, I checked these by hand:

Request	Expected
PUT /users/1 with { "name": "A", "email": "a@e.com" }	200, user updated
PUT /users/9999 with a valid body	404, not a crash
PUT /users/abc with a valid body	404 — Number("abc") is NaN, misses the lookup
PUT /users/1 with { "name": "Only a name" }	400
PUT /users/1 with { "name": " ", "email": "a@e.com" }	400
PUT /users/1 with { "name": 42, "email": "a@e.com" }	400
PUT /users/1 with no body	400
PUT /users/1 with { "name": "A", "email": "a@e.com", "id": 99, "admin": true }	200, extra fields ignored — the id can't be rewritten

The commits are split by layer (store helper → endpoint → notes), so they read cleanly one at a time.

🤖 Generated with Claude Code