Partial update of the current user's profile.
Fields the client is allowed to update on the current user.
onboarding_complete is deliberately not writable here. It is owned by the backend (set by OnboardingSubscriber when the LLM deletes BOOTSTRAP.md or heuristic evidence appears) so the conversational onboarding can't be short-circuited by the UI.
data_sharing_consent is deliberately not writable here either: it has its own dedicated endpoint (PUT /api/user/data-sharing-consent) that always stamps data_sharing_consent_at. Routing it through this generic patch endpoint would lose the timestamp guarantee.
model_config pins extra="ignore" so unknown fields (including data_sharing_consent if a client tries to slip it through here) are silently dropped. This is the contract the dedicated-endpoint test relies on. If pydantic ever flips the global default to "forbid", this declaration keeps the contract stable.
Successful Response