PATCH /api/v1/repos/{owner}/{name}/labels/{id} renames or recolours a label, as MCP repo_labels update and the labels page already do #7865

Today the labels page (POST …/settings/labels/:id) and MCP repo_labels update can rename or recolour a label. The HTTP API can only list, create and delete one (src/http/api/labels.ts), so an agent or script on plain HTTP cannot fix a typo without deleting the label, and that strips it from every issue.

Done:

• [ ] PATCH /api/v1/repos/:owner/:name/labels/:id with { name?, color? } (at least one) calls the existing updateLabel in src/actions/repos.ts and answers 200 with the label { id, name, color }.
• [ ] It needs an admin token scope (requireScope(ctx, "admin")), as POST and DELETE do. A non-admin is refused the same way they are. An unknown id is 404. Neither field given, a name another label already has, or a colour that is not six hex digits is 422, with the words updateLabel already uses.
• [ ] The label keeps its id, so every issue and pull that carries it still does.
• [ ] The OpenAPI contract gains src/contract/openapi/routes/patchApiV1ReposOwnerNameLabelsId.ts, shaped like deleteApiV1ReposOwnerNameLabelsId.ts, and the contract test passes.
• [ ] test/api-labels-update.test.ts covers rename, recolour, an issue still carrying the renamed label, admin-only, 404 and 422. Each case fails without the route.

Files: src/http/api/labels.ts, src/contract/openapi/routes/patchApiV1ReposOwnerNameLabelsId.ts, test/api-labels-update.test.ts. Risks: do not touch docs/MCP.md or README.md (hot). The MCP tool's doc string in src/http/mcp/tools/repo_labels.ts may say PATCH …/labels/:id in place of "as the labels page"; nothing else there changes. Builder: mason or torque (API route plus contract).