Add PUT /users/:id (update a user) - #92

Summary

• Add store.updateUser(id, { name, email }) — reuses getUserById, returns undefined for an unknown id so the route can branch on it the same way GET /:id already does.
• Add PUT /users/:id in routes/users.js: 400 when name or email is missing (same validation as POST /), 404 when the id doesn't exist, 200 with the updated user otherwise.
• Add NOTES.md with the plan, model choice, commit split, and self-review notes.

No changes to server.js or any test file — tests/update-user.test.js was already written and is now green.

Test plan

• npm test — 9/9 passing, including all three update-user.test.js cases (update, 404, 400) and the notes.test.js checks.
• npm run lint — clean.
• Manually reviewed the diff for edge cases: non-numeric :id (Number("x") is NaN, never matches a real id, so it 404s instead of crashing), empty-string name/email (still falsy, still 400s), and confirmed express.json() is already wired up for PUT the same as POST.

A reviewer should specifically try: updating a real user (200 + updated fields), PUT /users/9999 (404), and a PUT with only name or only email (400).