feat: simplify fetch_url allowlist + add update_connection tool

Part 1 — fetch_url validation simplification
  Now that Connection.allowed_url_hosts exists, it's the ONLY check.
  The old 2-label suffix-overlap rule against yarn_rm_url is gone.

  - Connection.allowed_url_hosts: list[str] = Field(default_factory=list)
    (was list[str] | None = None). Default empty list means the
    connection has no fetch access; the user must explicitly opt in
    via save_connection or update_connection.
  - _validate_url_host drops the yarn_rm_url parameter and the
    _host_suffix_overlap helper. Now: scheme/host/IP checks, then
    empty-reject, then glob match. Reject everything else.
  - fetch_url's error message now points the user at
    Connection.allowed_url_hosts as the fix.
  - The label-by-label glob check from the previous commit is kept
    (SSRF guard: 'ccam*' matches 'ccam50' but NOT 'ccam50.evil.com').

Part 2 — update_connection tool
  PATCH-style update for an existing Connection record. Only the
  fields the caller provides are changed. Same pattern as
  update_pending_job: req.model_dump(exclude_none=True), with
  'name' popped before passing to the store.

  To CLEAR a field (e.g. drop auth_password), use delete_connection
  + save_connection. This is YAGNI; the alternative (model_fields_set
  to distinguish 'omitted' from 'null') adds surface for bugs.

  - ConnectionStore.update(name, **fields): get, model_copy(update=...),
    save. Lock + atomic write. Re-validates the patched record.
  - update_connection tool function: passes fields through to the
    store, logs which fields were changed.
  - UpdateConnectionRequest Pydantic model: 12 mutable fields + name.
  - /update_connection route with operation_id='update_connection'.
  - 9 new unit tests in test_connection_tools.py (PATCH, dict/list
    replace-not-merge, unknown name 404, validation of patched record,
    disk persistence).
  - test_fetch_url.py: existing 21 tests updated; 3 new tests for
    the empty/None/missing allowed_url_hosts cases.
  - test_mcp_routes.py: assert 22 tool routes.
  - README: update_connection row added; fetch_url row updated.

Tests: 386 passed (up from 377, +9 net).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

spark_executor/server.py

@@ -11,6 +11,7 @@ from spark_executor.tools.connections import (
     get_connection,
     list_connections,
     save_connection,
+    update_connection,
 )
 from spark_executor.tools.write_job import write_job_file
 from spark_executor.tools.job_file import read_job_file, update_job_file
@@ -36,6 +37,7 @@ from spark_executor.tools.requests import (
     PrepareSubmitJobRequest,
     ReadJobFileRequest,
     SaveConnectionRequest,
+    UpdateConnectionRequest,
     UpdateJobFileRequest,
     UpdatePendingJobRequest,
 )
@@ -396,6 +398,28 @@ def _get_connection(req: ConnectionNameRequest):
     return get_connection(req.name)
 
 
+@app.post(
+    "/update_connection",
+    operation_id="update_connection",
+    summary="Update an existing connection's fields",
+    description=(
+        "Apply a partial update (PATCH) to an existing Connection record. "
+        "Only the fields you provide are changed; the rest are kept as-is. "
+        "The `name` is the immutable identifier (use delete_connection + "
+        "save_connection to rename).\n\n"
+        "To CLEAR an optional field (e.g. remove `yarn_rm_url`), use "
+        "delete_connection followed by save_connection with the field omitted. "
+        "This tool cannot clear fields — only replace them.\n\n"
+        "Returns the full updated Connection record. 404 if no Connection "
+        "with the given name exists."
+    ),
+)
+def _update_connection(req: UpdateConnectionRequest):
+    fields = req.model_dump(exclude_none=True)
+    fields.pop("name", None)  # name is the identity, not a field to patch
+    return update_connection(name=req.name, **fields)
+
+
 @app.post(
     "/delete_connection",
     operation_id="delete_connection",