Update a document's caller tags

Post-ingest update of the caller tags accepted at upload time (batch_id and metadata). metadata is MERGED over the stored bag — a patch key wins, null is a stored value (never a deletion), and the merged bag must satisfy the same caps as at ingest (≤50 keys, key ≤128 chars, string value ≤1024 chars) or the request is rejected with the document unchanged. batch_id is three-state: a non-blank string sets it, null clears it, and omitting the field leaves it untouched. Note that a byte-identical re-upload does NOT update tags (dedup keeps the canonical document's original tags) — this endpoint is the way to change what an existing document id carries. Pipelines read batch_id/metadata at run time, so a later run or rerun of the document picks the new tags up.