feat: simplify fetch_url allowlist + add update_connection tool

Part 1 — fetch_url validation simplification
  Now that Connection.allowed_url_hosts exists, it's the ONLY check.
  The old 2-label suffix-overlap rule against yarn_rm_url is gone.

  - Connection.allowed_url_hosts: list[str] = Field(default_factory=list)
    (was list[str] | None = None). Default empty list means the
    connection has no fetch access; the user must explicitly opt in
    via save_connection or update_connection.
  - _validate_url_host drops the yarn_rm_url parameter and the
    _host_suffix_overlap helper. Now: scheme/host/IP checks, then
    empty-reject, then glob match. Reject everything else.
  - fetch_url's error message now points the user at
    Connection.allowed_url_hosts as the fix.
  - The label-by-label glob check from the previous commit is kept
    (SSRF guard: 'ccam*' matches 'ccam50' but NOT 'ccam50.evil.com').

Part 2 — update_connection tool
  PATCH-style update for an existing Connection record. Only the
  fields the caller provides are changed. Same pattern as
  update_pending_job: req.model_dump(exclude_none=True), with
  'name' popped before passing to the store.

  To CLEAR a field (e.g. drop auth_password), use delete_connection
  + save_connection. This is YAGNI; the alternative (model_fields_set
  to distinguish 'omitted' from 'null') adds surface for bugs.

  - ConnectionStore.update(name, **fields): get, model_copy(update=...),
    save. Lock + atomic write. Re-validates the patched record.
  - update_connection tool function: passes fields through to the
    store, logs which fields were changed.
  - UpdateConnectionRequest Pydantic model: 12 mutable fields + name.
  - /update_connection route with operation_id='update_connection'.
  - 9 new unit tests in test_connection_tools.py (PATCH, dict/list
    replace-not-merge, unknown name 404, validation of patched record,
    disk persistence).
  - test_fetch_url.py: existing 21 tests updated; 3 new tests for
    the empty/None/missing allowed_url_hosts cases.
  - test_mcp_routes.py: assert 22 tool routes.
  - README: update_connection row added; fetch_url row updated.

Tests: 386 passed (up from 377, +9 net).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/unit/test_connection_tools.py

@@ -1,4 +1,5 @@
 # coding=utf-8
+import json
 from pathlib import Path
 
 import pytest
@@ -120,3 +121,68 @@ def test_delete_connection_returns_status(_fresh_store):
 def test_delete_connection_unknown_raises(_fresh_store):
     with pytest.raises(KeyError):
         connections.delete_connection("missing")
+def test_update_connection_changes_specified_field(_fresh_store):
+    connections.save_connection(name="prod", master="yarn")
+    out = connections.update_connection(name="prod", master="spark://new:7077")
+    assert out["master"] == "spark://new:7077"
+    assert _fresh_store.get("prod").master == "spark://new:7077"
+
+
+def test_update_connection_keeps_omitted_fields(_fresh_store):
+    connections.save_connection(
+        name="prod",
+        master="yarn",
+        deploy_mode="client",
+        yarn_rm_url="http://rm:8088",
+    )
+    out = connections.update_connection(name="prod", deploy_mode="cluster")
+    assert out["deploy_mode"] == "cluster"
+    assert out["master"] == "yarn"
+    assert out["yarn_rm_url"] == "http://rm:8088"
+
+
+def test_update_connection_with_no_fields_is_noop(_fresh_store):
+    connections.save_connection(name="prod", master="yarn", deploy_mode="client")
+    out = connections.update_connection(name="prod")
+    assert out["master"] == "yarn"
+    assert out["deploy_mode"] == "client"
+
+
+def test_update_connection_allows_url_hosts_change(_fresh_store):
+    connections.save_connection(name="prod", master="yarn")
+    out = connections.update_connection(name="prod", allowed_url_hosts=["ccam*"])
+    assert out["allowed_url_hosts"] == ["ccam*"]
+
+
+def test_update_connection_replaces_not_merges_dict(_fresh_store):
+    connections.save_connection(name="prod", master="yarn", spark_conf={"a": "1"})
+    out = connections.update_connection(name="prod", spark_conf={"b": "2"})
+    assert out["spark_conf"] == {"b": "2"}
+
+
+def test_update_connection_replaces_not_merges_list(_fresh_store):
+    connections.save_connection(
+        name="prod",
+        master="yarn",
+        allowed_url_hosts=["ccam*"],
+    )
+    out = connections.update_connection(name="prod", allowed_url_hosts=["nm*"])
+    assert out["allowed_url_hosts"] == ["nm*"]
+
+
+def test_update_connection_raises_for_unknown_name(_fresh_store):
+    with pytest.raises(KeyError, match="Connection not found"):
+        connections.update_connection(name="missing", master="yarn")
+
+
+def test_update_connection_validates_patched_connection(_fresh_store):
+    connections.save_connection(name="prod", master="yarn")
+    with pytest.raises(ValueError, match="master must be"):
+        connections.update_connection(name="prod", master="http://bad")
+
+
+def test_update_connection_persists_to_disk(_fresh_store, tmp_path):
+    connections.save_connection(name="prod", master="yarn")
+    connections.update_connection(name="prod", master="spark://new:7077")
+    raw = json.loads((tmp_path / "connections.json").read_text())
+    assert raw["prod"]["master"] == "spark://new:7077"