Add validated user update endpoint

[Gidr0Gen]

What changed

• add a store helper that updates a user by id
• add PUT /users/:id with trimmed input and basic email validation
• return clear 400 responses for invalid input and 404 for unknown users
• document the plan, model choice, commit split, and self-review in NOTES.md

Why

The users API needs a safe update path that follows the existing store abstraction instead of mutating data in the route.

Verification

• pnpm test — 9/9 passing
• pnpm lint — passing

Reviewer checks

Please verify the successful update path as well as missing-field, invalid-email, and unknown-user responses.