Body for PATCH /email-domains/{id}.

Two clusters of mutable fields:

• Hail-mail addressing — the user/org prefix pair (only valid on kind='hail_mail' rows; the handler returns 422 if a tenant tries to PATCH these on a custom row).
• Inbound action — inbound_enabled + forward_to + the optional forward_rate_per_hour cap. These apply to either kind, but this milestone routes inbound only to hail_mail rows; custom-domain inbound (MX delegation) is the next milestone.

Every field is independently optional so PATCH semantics work the way callers expect: send only what you want to change. The route enforces the cross-field rules (the CHECK constraint on the table requires an action when inbound_enabled is true) — we don't re-implement it here because the patch may merge with existing row state to satisfy the invariant.