Patch Integrations

Update integration fields. Secret fields are encrypted before storage. Send null to clear a field. Only include fields that changed. Prefer POST /update-integrations for a typed, agent-style contract.

When ces_wif_config_json is included in the payload, a background Google Agents sync (CES + DFCX) is kicked off fire-and-forget so the credential save is never blocked by a potentially slow sync.