Update effective date for a facility-group-network enrollment

Updates the effective start date and/or termination date for a single TenantGroupFacilityNetwork (TGFN) leaf row independently of its parent TenantGroupFacility association. Use this when you need to adjust a network enrollment date without changing the parent facility-group association dates; use PUT .../groups/{certifyGroupId}/effective-date to change the parent facility-group dates (which can optionally cascade to network records) instead. The service-layer enforces a cross-level invariant: the request effectiveDate cannot precede the parent facility-group effectiveDate. Returns the raw updated TenantGroupFacilityNetwork record as an untyped JSON object, not a curated response DTO. CP-28250 phase-2 / sub-task CP-28250-Phase2-BE.