Public-API PATCH /v1/customers/{id}.

Mirrors UpdateLeadRequest (Gap 8 Option A, shipped PR #248). The status field is a virtual flag — the controller maps it to the underlying archived_at timestamp before writing.