Gap 8: Update lead via Public API. All fields are optional (PATCH semantics).
Allowed status values mirror the admin kanban whitelist (LeadController::index statuses array) plus the open-quote states used in Lead::findRecentOpenForCustomer.