feat: simplify fetch_url allowlist + add update_connection tool

Part 1 — fetch_url validation simplification
  Now that Connection.allowed_url_hosts exists, it's the ONLY check.
  The old 2-label suffix-overlap rule against yarn_rm_url is gone.

  - Connection.allowed_url_hosts: list[str] = Field(default_factory=list)
    (was list[str] | None = None). Default empty list means the
    connection has no fetch access; the user must explicitly opt in
    via save_connection or update_connection.
  - _validate_url_host drops the yarn_rm_url parameter and the
    _host_suffix_overlap helper. Now: scheme/host/IP checks, then
    empty-reject, then glob match. Reject everything else.
  - fetch_url's error message now points the user at
    Connection.allowed_url_hosts as the fix.
  - The label-by-label glob check from the previous commit is kept
    (SSRF guard: 'ccam*' matches 'ccam50' but NOT 'ccam50.evil.com').

Part 2 — update_connection tool
  PATCH-style update for an existing Connection record. Only the
  fields the caller provides are changed. Same pattern as
  update_pending_job: req.model_dump(exclude_none=True), with
  'name' popped before passing to the store.

  To CLEAR a field (e.g. drop auth_password), use delete_connection
  + save_connection. This is YAGNI; the alternative (model_fields_set
  to distinguish 'omitted' from 'null') adds surface for bugs.

  - ConnectionStore.update(name, **fields): get, model_copy(update=...),
    save. Lock + atomic write. Re-validates the patched record.
  - update_connection tool function: passes fields through to the
    store, logs which fields were changed.
  - UpdateConnectionRequest Pydantic model: 12 mutable fields + name.
  - /update_connection route with operation_id='update_connection'.
  - 9 new unit tests in test_connection_tools.py (PATCH, dict/list
    replace-not-merge, unknown name 404, validation of patched record,
    disk persistence).
  - test_fetch_url.py: existing 21 tests updated; 3 new tests for
    the empty/None/missing allowed_url_hosts cases.
  - test_mcp_routes.py: assert 22 tool routes.
  - README: update_connection row added; fetch_url row updated.

Tests: 386 passed (up from 377, +9 net).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -100,10 +100,11 @@ MCP 客户端需要先执行 `initialize` 握手，拿到 `mcp-session-id` 后
 
 | 工具 | 作用 |
 | --- | --- |
-| `save_connection` | 保存或更新一个 Spark/YARN 连接配置 |
-| `list_connections` | 列出所有连接配置 |
-| `get_connection` | 按名称读取连接配置 |
-| `delete_connection` | 删除连接配置 |
+ | `save_connection` | 保存或更新一个 Spark/YARN 连接配置 |
+ | `list_connections` | 列出所有连接配置 |
+ | `get_connection` | 按名称读取连接配置 |
+ | `delete_connection` | 删除连接配置 |
+ | `update_connection` | 部分更新一个已存在的连接 (PATCH 语义, 只改提供的字段) |
 | `write_job_file` | 将 LLM 已生成的 PySpark 代码写入服务端文件 |
 | `read_job_file` | 读取已存在的 PySpark 脚本内容 |
 | `update_job_file` | 覆盖更新已存在的 PySpark 脚本 |
@@ -120,7 +121,7 @@ MCP 客户端需要先执行 `initialize` 握手，拿到 `mcp-session-id` 后
 | `get_external_job_status` | 查询**非本服务提交**的外部 YARN application 状态（按 `application_id` + `connection_name`） |
 | `get_external_job_result` | 查询外部 YARN application 终态结果视图 |
 | `get_external_job_logs` | 拉取外部 YARN application 的聚合日志 |
-| `fetch_url` | 代理 HTTP GET 到集群内网 URL (host 围栏: 默认 2 段后缀匹配 `yarn_rm_url`, 或匹配 `Connection.allowed_url_hosts` glob) |
+ | `fetch_url` | 代理 HTTP GET 到集群内网 URL (host 受 `Connection.allowed_url_hosts` glob allowlist 约束, 空则全拒) |
 
 ### Files MCP 工具