Update a plan review

Only the fields you pass change.

The connector holds no business rules: apps/api’s /svc mount validates the request, checks the token’s scope and records an audit event for every change. Its errors come back as tool errors, unchanged.