Add PUT /users/:id endpoint with input hardening

[pppmppp]

Summary

• Adds PUT /users/:id to update an existing user's name and email (200 on success, 404 for unknown id, 400 for missing or blank fields)
• Adds updateUser helper to db/store.js, returning a shallow copy so callers cannot mutate the stored record
• Hardens body parsing in both PUT and POST: req.body || {} guard prevents a crash when Content-Type is absent; typeof check before .trim() prevents a TypeError crash from null or non-string fields
• Validates that :id is a positive integer before hitting the store, so malformed ids return 400 instead of a misleading 404
• Adds NOTES.md write-up (required by the grading suite)

Commit breakdown

1. Add updateUser helper to the in-memory store — store layer only
2. Add PUT /users/:id route to update an existing user — route wired up; all 9 tests green
3. Add NOTES.md submission write-up — grading write-up
4. Remove dead validation throw from updateUser — store guard was unreachable via the route and diverged semantically from the route's .trim() check
5. Guard against null and non-string body fields in PUT and POST handlers — null fields and non-string values now return 400 instead of an unhandled 500

Test plan

• npm test — all 9 tests pass
• PUT /users/:id with valid body → 200 + updated user
• PUT /users/:id with unknown id → 404
• PUT /users/:id with missing field → 400
• PUT /users/abc (non-numeric id) → 400
• PUT /users/1 with { name: null } → 400 (not 500)
• POST /users without Content-Type header → 400 (not 500)

🤖 Generated with Claude Code