Applies RFC 7396 JSON Merge-Patch to update key metadata fields.

Workflow:

1. Validates tenant access from JWT.
2. Updates metadata fields in PostgreSQL.
3. Publishes audit event to Kafka.

Patchable fields (see AdminKeyMergePatchRequest schema for full details):

• displayName: Human-readable key name (max 255 chars).
• description: Key description (max 1000 chars).
• exportable: Boolean flag for key export permission.
• expiresAt: Hard expiration UTC timestamp.
• softLimitExpiration: Soft expiration UTC timestamp (warning threshold).
• maxUsageLimit: Hard usage counter limit.
• softUsageLimit: Soft usage counter limit (must be less than maxUsageLimit).

Validation rules:

• displayName length <= 255 characters.
• description length <= 1000 characters.
• softUsageLimit must be strictly less than maxUsageLimit if both are set.
• Explicit null in the patch deletes the field (standard RFC 7396 semantics).
• Absent fields leave the current value unchanged.

Authorization: requires scope admin.keys.patch.