Update a subnet

Applies a partial update to a subnet of the given network ("Save subnet" in the the network detail page subnet editor). Mutable fields are the subnet name, CIDR, gateway IP, DHCP flag and per-subnet DNS nameservers; only fields present in the body are changed and the updated Subnet resource is returned for in-place table refresh. Validation: subnet must exist under the given network else 404 NOT_FOUND (also 404 when networkId itself is unknown); a new cidr must remain inside the network address space, not overlap sibling subnets, and still contain every fixed IP already assigned to ports — violations map to 409 CONFLICT; gatewayIp must lie inside the (possibly new) CIDR else 422 VALIDATION_FAILED; dnsNameservers entries must be valid IP literals else 422; name must stay unique within the network else 409 CONFLICT. Async & state: Synchronous (200); the control-plane write completes inline and no transitional state exists. A resource.updated SSE frame for the parent network (kind: network, patch: {subnets}) is emitted so other sessions converge. Errors: 401 unauthenticated; 403 caller lacks contributor rights; 404 unknown networkId/subnetId; 409 CONFLICT on CIDR overlap, in-use fixed IPs or duplicate name; 412 PRECONDITION_FAILED on stale If-Match; 422 on field validation failure; 500 on apply failure. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. A repeated identical PATCH re-applies the same fields (same end state) and records another network.subnet.update audit Operation. The precondition is the parent network's ETag, computed from its subnets, so resending a request that already changed the subnet with its original If-Match gets 412. If-Match with the detail-read ETag is honored — a mismatch returns 412 and leaves the subnet unchanged.