Add workspace user update endpoint

[caydyan]

Closes #622.\n\n## Summary\n- Add authenticated PUT /workspaces/users/{uuid}/{user} for updating a workspace user membership to a new pubkey.\n- Validate UPDATE USER access, workspace membership, target person existence, duplicate membership, workspace admin protection, and self-update protection.\n- Preserve existing workspace user roles when moving membership to the new pubkey.\n- Add route coverage, focused handler coverage, and refresh the generated database mock for the existing GetBountyByUnlockCode interface method so handler tests compile.\n\n## Validation\n- go test ./routes -run TestWorkspaceRoutes -count=1\n- go test ./handlers -run TestUpdateWorkspaceUser -count=0\n- go test ./... -count=0\n- go test ./handlers -run TestUpdateWorkspaceUser -count=1 could not complete locally because the documented Postgres test DB was not available on localhost:5532; Docker also returned a daemon API error when probed.\n\nBTC wallet: bc1qev5ant33v5y89qqjvcf4mh9hlax5svqf5xd7gc

[caydyan]

Current-head validation rerun on 672d0ce8d9f662b7ef8c7ad1f82b0758abe1d797:

• git diff --check origin/master...HEAD
• go test ./routes -run TestWorkspaceRoutes -count=1
• go test ./handlers -run TestUpdateWorkspaceUser -count=0
• go test ./... -count=0

The focused runtime handler test is still blocked by local infrastructure rather than a source compile failure:

• go test ./handlers -run TestUpdateWorkspaceUser -count=1 -v fails immediately because the documented test Postgres on localhost:5532 is not running (connect: connection refused).
• docker ps still returns a local Docker daemon API 500 in this environment, so I cannot start docker/testdb-docker-compose.yml here.

Local worktree is clean after the rerun.