feat: accept partial bodies on PUT /api/instances/:vmid

Merge the request body onto the existing instance row before validating,
so external callers (n8n, scripts) can send only the fields they want to
change instead of GET-then-splat-then-PUT the full record.

Mirrors the partial-update pattern already used by PUT /api/jobs/:id.
Full-body PUTs (today's frontend) are unaffected.

server/routes.js

@@ -112,13 +112,17 @@ router.post('/instances', (req, res) => {
 router.put('/instances/:vmid', (req, res) => {
   const vmid = parseInt(req.params.vmid, 10);
   if (!vmid) return res.status(400).json({ error: 'invalid vmid' });
-  if (!getInstance(vmid)) return res.status(404).json({ error: 'instance not found' });
 
-  const errors = validate(req.body);
+  const existing = getInstance(vmid);
+  if (!existing) return res.status(404).json({ error: 'instance not found' });
+
+  const merged = { ...existing, ...(req.body ?? {}) };
+
+  const errors = validate(merged);
   if (errors.length) return res.status(400).json({ errors });
 
   try {
-    const data = normalise(req.body);
+    const data = normalise(merged);
     updateInstance(vmid, data);
     res.json(getInstance(data.vmid));
   } catch (e) {