feat: simplify fetch_url allowlist + add update_connection tool

Part 1 — fetch_url validation simplification
  Now that Connection.allowed_url_hosts exists, it's the ONLY check.
  The old 2-label suffix-overlap rule against yarn_rm_url is gone.

  - Connection.allowed_url_hosts: list[str] = Field(default_factory=list)
    (was list[str] | None = None). Default empty list means the
    connection has no fetch access; the user must explicitly opt in
    via save_connection or update_connection.
  - _validate_url_host drops the yarn_rm_url parameter and the
    _host_suffix_overlap helper. Now: scheme/host/IP checks, then
    empty-reject, then glob match. Reject everything else.
  - fetch_url's error message now points the user at
    Connection.allowed_url_hosts as the fix.
  - The label-by-label glob check from the previous commit is kept
    (SSRF guard: 'ccam*' matches 'ccam50' but NOT 'ccam50.evil.com').

Part 2 — update_connection tool
  PATCH-style update for an existing Connection record. Only the
  fields the caller provides are changed. Same pattern as
  update_pending_job: req.model_dump(exclude_none=True), with
  'name' popped before passing to the store.

  To CLEAR a field (e.g. drop auth_password), use delete_connection
  + save_connection. This is YAGNI; the alternative (model_fields_set
  to distinguish 'omitted' from 'null') adds surface for bugs.

  - ConnectionStore.update(name, **fields): get, model_copy(update=...),
    save. Lock + atomic write. Re-validates the patched record.
  - update_connection tool function: passes fields through to the
    store, logs which fields were changed.
  - UpdateConnectionRequest Pydantic model: 12 mutable fields + name.
  - /update_connection route with operation_id='update_connection'.
  - 9 new unit tests in test_connection_tools.py (PATCH, dict/list
    replace-not-merge, unknown name 404, validation of patched record,
    disk persistence).
  - test_fetch_url.py: existing 21 tests updated; 3 new tests for
    the empty/None/missing allowed_url_hosts cases.
  - test_mcp_routes.py: assert 22 tool routes.
  - README: update_connection row added; fetch_url row updated.

Tests: 386 passed (up from 377, +9 net).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

spark_executor/tools/requests.py

@@ -128,8 +128,10 @@ class SaveConnectionRequest(BaseModel):
             "Optional list of fnmatch glob patterns for hosts the fetch_url tool "
             "may access. See Connection.allowed_url_hosts for full semantics. "
             "Example for single-label host clusters: ['ccam*'] allows any host "
-            "starting with 'ccam' (ccam1, ccam2, ..., ccam99). Default None means "
-            "only the default 'shares >= 2 labels of suffix with yarn_rm_url' rule."
+            "starting with 'ccam' (ccam1, ccam2, ..., ccam99). If omitted, None, "
+            "or empty, the saved connection will have allowed_url_hosts=[] (the "
+            "default), meaning fetch_url will reject every URL until the list is "
+            "populated via update_connection."
         ),
     )
 
@@ -412,3 +414,65 @@ class FetchUrlRequest(BaseModel):
             "ssl_verify / ssl_ca_bundle are reused for the request."
         ),
     )
+
+
+class UpdateConnectionRequest(BaseModel):
+    name: str = Field(
+        ...,
+        description=(
+            "Name of the existing Connection to update (immutable identifier). "
+            "If you want to rename, use delete_connection + save_connection."
+        ),
+    )
+    master: str | None = Field(
+        default=None,
+        description="New Spark master URL. Omit to keep current.",
+    )
+    deploy_mode: str | None = Field(
+        default=None,
+        description="New Spark deploy mode ('cluster' or 'client'). Omit to keep current.",
+    )
+    yarn_rm_url: str | None = Field(
+        default=None,
+        description="New YARN ResourceManager REST base URL. Omit to keep current.",
+    )
+    spark_conf: dict[str, str] | None = Field(
+        default=None,
+        description="Replacement Spark conf dict (not merged with existing). Omit to keep current.",
+    )
+    ssl_verify: bool | None = Field(
+        default=None,
+        description="New SSL verify setting. Omit to keep current.",
+    )
+    ssl_ca_bundle: str | None = Field(
+        default=None,
+        description="New SSL CA bundle path. Omit to keep current.",
+    )
+    auth_type: str | None = Field(
+        default=None,
+        description="New auth mode. Omit to keep current.",
+    )
+    auth_user: str | None = Field(
+        default=None,
+        description="New auth username. Omit to keep current.",
+    )
+    auth_password: str | None = Field(
+        default=None,
+        description="New auth password. Omit to keep current.",
+    )
+    auth_principal: str | None = Field(
+        default=None,
+        description="New Kerberos principal. Omit to keep current.",
+    )
+    auth_keytab: str | None = Field(
+        default=None,
+        description="New Kerberos keytab path. Omit to keep current.",
+    )
+    allowed_url_hosts: list[str] | None = Field(
+        default=None,
+        description=(
+            "Replacement allowed_url_hosts list (not merged). Omit to keep current. "
+            "Pass an empty list to deny all hosts (the default for new connections). "
+            "Example: ['ccam*'] allows ccam1-ccam99."
+        ),
+    )