Update User

Partial update (admin). Only fields present in the request body are touched.

The companies replace is role-preserving; memberships sets roles explicitly. Mutually exclusive (422).

409 when an operator aims is_admin: false or is_active: false at themselves (:func:_refuse_self_removal), and 409 if the change would leave the instance with no active administrator at all (:func:_guard_last_admin). Nothing re-promotes a demoted administrator, so this is not recoverable through the product.

Audited, like every other write on somebody else's account. Note the audit records that the account was changed and which fields, not their old and new values: a password is in scope for this route and an oversight trail is not a place to widen the blast radius of reading it.