feat(data-app): add data-app update and report Storage access in detail (#737)

[padak]

What

Adds kbagent data-app update and surfaces the Storage-access state on data-app detail.

kbagent data-app update --project P --app-id 74021026 --workspace
kbagent data-app deploy --project P --app-id 74021026 --wait

Flags: --workspace/--no-workspace, --auto-suspend N, --size, --auth, --git-branch, --branch, --dry-run.

Why

data-app create could set runtime.workspace.enabled and parameters.autoSuspendAfterSeconds; nothing could change them afterwards. For an app created in the UI, or by an older kbagent, the only CLI path was sync init + sync pull + hand-editing _config.yml + sync push — heavy and schema-aware for a two-field change.

data-app detail did not report Storage access either (it shows size, auto-suspend, git and secrets, not runtime.workspace), so the symptom that motivated the issue — an app that deploys, reports state=running, passes its health probe and then fails every Storage call — could not be diagnosed from the CLI at all.

Design notes

• Read-modify-write over the whole config body. The Storage API's configuration field is a full-document overwrite, so only the fields the caller passes are touched: parameters.dataApp.secrets, the encrypted git #password and the storage input/output mapping all survive bit-identical. Asserted by a test.
• --workspace is tri-state, not a boolean. Omitting it leaves Storage access unchanged. A flag defaulting to False would silently revoke Storage access on every --auto-suspend change.
• --no-workspace deletes runtime.workspace rather than writing enabled: false — byte-identical to what create --no-workspace produces, so the two paths cannot diverge and sync diff sees no phantom drift.
• A no-op update writes nothing. If every requested value already matches: changed: [], deploy_required: false, no config version minted, no Storage PUT.
• --git-branch is external-repo only. A Keboola-managed repo has no parameters.dataApp.git block (the Git Service owns the link), so it fails with DATA_APP_INVALID_GIT instead of inventing one.
• Never auto-deploys. Per the §9 redeploy contract the running container keeps its pinned configVersion; the result carries deploy_required: true and the exact next command.

File placement

services/data_app_service.py is grandfathered by scripts/check_file_size.py at 1641 code lines and may only shrink, so the new logic could not land inline. It is a DataAppUpdateMixin in services/_data_app_update.py, into which _load_data_app_storage_config was also moved (the service is now 1616). The CLI command lives in commands/_data_app_settings.py, following the existing _data_app_git.py / _data_app_runtime.py split so commands/data_app.py stays under its soft ceiling.

Surfaces updated

Permission registry (data-app.update = write), PATCH /data-apps/{project}/{app_id} + SERVE_COMMAND_MAP, docs/web-server-endpoints.md, CLAUDE.md, context.py AGENT_CONTEXT, SKILL.md (regenerated), commands-reference.md, gotchas.md, data-app-workflow.md, keboola-expert.md. Version-gated as vNEXT per the release process.

How it was tested

• 24 new unit tests: service-level read-modify-write, key preservation, disable-drops-the-key, no-op skip, dry-run redaction, validation matrix, managed-repo --git-branch refusal; CLI flag plumbing including the tri-state --workspace assertion.
• One live E2E case (test_data_app_update_toggles_storage_access) that creates an app, toggles Storage access off and on against a real stack, verifies detail reads it back, and confirms the repeat request mints no config version.
• make check green (lint, format, ty, skill, version, version-gates, command-sync, endpoints, changelog, error-codes, sentinel-guards, file-size, 6590 tests).

Fixes #737