Update Search Tool

Update a stored search tool. Omitted fields are left as-is; an explicit null clears them.

api_key follows the same rule: omit it to keep the stored key, send a new one to rotate, or send null to clear it (a keyless SearXNG backend). The row is locked FOR UPDATE so the expected_updated_at check and the write it guards are atomic. The tool as it will be after the update is validated, so a change that would leave it unusable (clearing the key of a provider that needs one) is refused rather than stored.