Update person

Partial PII patch on a cross-tenant person: a field present in the JSON body is applied — even an empty string clears it — while an absent field is left unchanged, so a {} body is a no-op. username is rejected with 400 (it is account-scoped, not person-scoped; use PATCH /accounts/{id} instead). The regulated block — DOB, home address, primary email and phone — is echoed back in the response only to a system-admin (global) caller, never to a tenant_admin, so an empty patch cannot be used as a read of those fields at the lower gate.