Add PUT /users/:id (update a user)

[tskaara]

Summary

• Adds updateUser(id, { name, email }) to db/store.js, mirroring createUser's style: looks up the user by id and mutates it in place, returning undefined when the id doesn't exist.
• Adds PUT /users/:id to routes/users.js: validates name/email are present and are strings (400 otherwise), then 404s if the id doesn't exist, otherwise returns the updated user.
• id is only ever taken from the URL param, never the request body, so a client can't reassign a user's id.
• Adds NOTES.md explaining the plan, model choice, commit split, and what two rounds of self-review caught.

Test plan

• npm test — all 9 tests pass, including the three grading tests in tests/update-user.test.js (200 update, 404 unknown id, 400 missing field) and both NOTES.md tests.
• npm run lint — clean.
• Manual check (optional): npm start, then curl -X PUT localhost:3000/users/1 -H "Content-Type: application/json" -d '{"name":"X","email":"y@z.com"}' to confirm the not-found path (/users/9999) and validation path (missing or non-string field) both return the right status codes.

🤖 Generated with Claude Code