Changes a portal user's role, location scope or booking-notification setting. The
email in the path is matched case-insensitively. Absent properties are unchanged;
validation is the same as when adding a user. If nothing actually changes, the current
user is returned and no audit entry is written.

Last-admin guard: a provider must always have at least one Admin portal user.
Demoting an Admin when no other Admin remains fails with 409 last_admin.

Portal sessions cache the user's role, so a role change takes effect at their next
sign-in, not instantly. Changes are recorded in your activity log with a
field-by-field diff.