Set my first name when I have none

Gives the caller's own account a first name, only when it has none, so teammates in this workspace see a name instead of an email or nothing. This is what an AI app calls after asking the person what their team should call them. It writes only this account's display name: the person's own name, which identity checks read, and the person's accounts in other workspaces are never touched. It only fills: an account that already has a first name is 409 first_name_already_set and nothing is written, and changing a name is PATCH /me/person. A name is never replaced, even by a concurrent write. The name is trimmed and must be 1 to 100 characters, contain a letter, and hold no control or invisible characters (400 invalid_first_name). Tagged first-name so an OAuth client can be granted exactly this with the scope enforcer:first-name.write; a credential without it is 403 insufficient_scope.