Patch Agent Llm Connection

Partial-update one LLM connection by id.

apiKey: "********" (or partial sk-a****xyz) -> no-op on that field. apiKey: null -> clear. Other fields merge over the existing row, then the merged row re-validates against AgentLlmConnection. Returns the masked persisted shape.