No partial update (PATCH) — every edit must resend every field

PUT /bookmarks/{id} is a full replace -- every field is required, so a client that only wants to rename a bookmark (or just retag it) has to first GET the current record and resend everything back, or risk accidentally blanking fields it didn't mean to touch. This is extra round trips for every partial edit, and a real risk of accidental data loss if a client naively omits a field it didn't intend to change.

Only PUT (full replace, all fields required) exists. There is no way to update just the title, just the tags, or just the URL, independently.

ID=$(curl -s -X POST http://localhost:8081/bookmarks -H 'Content-Type: application/json'
-d '{"url":"https://example.com","title":"Old Title","tags":["go"]}' | jq -r .id) curl -i -X PATCH http://localhost:8081/bookmarks/$ID -H 'Content-Type: application/json'
-d '{"title":"New Title"}'

Expected: 200, title updated, url and tags unchanged

Actual: 405 Method Not Allowed

This needs to distinguish "field not present in the JSON body" from "field present but zero-valued" -- a plain struct with string/[]string fields can't tell those apart (both look like the Go zero value). It also needs a genuinely dynamic UPDATE ... SET ... clause (only setting the columns that were actually supplied), built the same "clause list + args slice in lockstep" way Store.List already builds its WHERE clause -- the same core lesson, applied to SET instead of WHERE.

Use pointer fields (or encoding/json's json.RawMessage/presence-checking pattern) in a new PatchRequest struct so "field absent" and "field present" are distinguishable; add a Store method that builds SET clauses only for the fields that were actually supplied, mirroring how Store.List builds WHERE clauses incrementally.