Update the signed-in user's profile

Runs user.updateProfile. PARTIAL update: send only the fields being changed. An omitted field is left untouched — it is not cleared — and at least one field must be present or the call is a 400. There is no clear-a-field verb: no field accepts JSON null (that is a 400 too), so a value can only be replaced, never erased. name is the field this route exists for. It writes user.name, the name the Settings account row and the checkout guest form both render, and it is the only writer of that column outside admin tooling — Sign in with Apple hands back a name on the first consent only, so for most native accounts it starts empty and stays that way until this call runs. An all-whitespace name is ignored rather than written (and an empty string is a 400), so a stray save cannot wipe a name the customer already set. CHANGING phone DELIBERATELY RESETS that number's verified state — phoneVerifiedAt goes back to null, so booking-confirmation SMS stops being delivered until the customer re-runs POST /v1/phone/request-otp then POST /v1/phone/verify-otp. Any screen with a phone field must say so and send them back through that flow; the reset is an audit fix, because without it a profile update could point a stay's confirmation SMS at another number while inheriting the old verification. dateOfBirth is an ISO-8601 date string (YYYY-MM-DD), not a Unix timestamp. nationality and country are ISO 3166-1 alpha-3; preferredCountry is alpha-2, and the three preference fields are enum-validated against the supported currency/language/country lists, so an unsupported value is a 400 rather than a silently stored string. avatarUrl must be HTTPS (or an empty string). Returns { success: true } only — it does not echo the saved row, so refetch GET /v1/account/profile when the screen needs to show what was stored.