Update a subcontractor

Updates a subcontractor.

IMPORTANT — contactPersons contract: clients SHOULD always send the full contactPersons list (not just deltas) on any update that may need to converge FGA. The service treats an omitted contactPersons field as 'no change requested', which means a previous failed FGA-sync attempt cannot be remediated by a partial update — only by a future request that includes the contactPersons array. The frontend SubcontractorDialog enforces this contract; direct API callers must do the same.

IMPORTANT — 500 semantics: a 500 response from this endpoint does NOT mean 'no changes were made'. The DB write commits before the FGA membership sync; if the sync fails, the row already reflects the new state but the FGA group is stale.

Recovery is NOT self-healing on retry: a retried PATCH with the same contactPersons array computes its diff against the now-persisted post-write list, produces an empty diff, and skips the FGA sync entirely — so the same request will succeed without fixing anything. The actual recovery paths are: (a) a future legitimate contact-list change whose diff happens to cover the missed entries, or (b) an operator-driven two-step PATCH (mutate the list to force a non-empty diff, then PATCH back). Operators are paged on the subcontractor.update.fga_sync_failed log event to drive (b). A background reconciliation job that obviates this manual recovery is tracked separately.