Add update() (full-replace PUT), CustomerRequest::fromResponse(), typed Customer fields

[loevgaard]

Summary

Implements four end-user DX feedback items, in their priority order:

1. update() support — new Client::put() / ClientInterface::put() (mirrors post(), both delegate to a shared private send()), ResourceEndpoint::updateOne() pipeline, and typed one-liners CustomersEndpoint::update(int, CustomerRequest): Customer and DraftOrdersEndpoint::update(int, DraftOrderRequest): Order.
2. Typed phone fields — telephoneAndFaxNumber / mobilePhone are now ?string properties on the response Customer (previously $raw-only).
3. Read-modify-write story — Payload::fromResponse(Resource $response): static, inherited by every request DTO: the response's full decoded body ($raw) is mapped into the request DTO via a dedicated Valinor mapper. Reference objects become Identifier instances via the new Identifier::fromReference() (field name inferred from the reference's single scalar <x>Number key, so identifiers round-trip back to the exact shape the server produced); server-computed fields, HATEOAS links and unmodeled schema fields are dropped as superfluous. The mapper is strict — present-but-malformed raw data throws (with node-path context) instead of being silently dropped, because a dropped field would be cleared server-side by the full-replace PUT. This works for orders too: DraftOrderRequest::fromResponse($order) maps nested Payloads (Recipient, Delivery, References, Line) recursively. To make mutation-after-prefill work, all Payload request DTOs are mutable (final class, no readonly); Payload itself became an abstract base class (was a marker interface); rector.php skips the ReadOnly rectors for src/Request/Customer and src/Request/Order.
4. Customer::$lastUpdated is now ?\DateTimeImmutable — Valinor's default date handling maps e-conomic's 2020-02-19T09:18:09Z format with no builder changes; wire string remains at $raw['lastUpdated'].

Also in this PR:

• Claims about full-replace PUT verified against the official e-conomic REST docs ("PUT to an existing ressource will overwrite the full object"; "To null a property you must exclude it from your JSON") — the null-stripping Payload transformer is mandatory, not cosmetic, since e-conomic rejects explicit nulls.
• Documented nuance found during verification: eInvoicingDisabledByDefault is "updatable only by using PATCH to /customers/:customerNumber" (the API's sole exception to its no-PATCH-on-JSON rule) — its value in a PUT body is ignored, so mutating it on a prefilled request has no effect through update().
• Fixes a pre-existing #[CoversClass(EconomicException::class)] on an interface in ExceptionHierarchyTest — PHPUnit 11 rejects interfaces as coverage targets, which would fail the CI mutation job.
• Removes AUDIT.md (its closeout note says it is safe to delete; the deletion was already staged).
• README: read-modify-write examples for customers and draft orders, full-replace warnings, updated endpoint table, supportDateFormats() caveat. CLAUDE.md updated to match.

BC notes (pre-release 1.x, latest tag v1.0.0-alpha)

• Customer::$lastUpdated changed type ?string → ?\DateTimeImmutable
• ClientInterface gained put()
• Request DTOs are no longer readonly; Payload is an abstract class instead of an interface (implements Payload → extends Payload)
• fromResponse() takes Resource (inherited generic) — passing the wrong resource class is a runtime mapping error, not a compile-time type error

Test plan

• PHPUnit: 173 tests / 445 assertions (32 new), including two full-body round-trip tests — customers and draft orders — that GET a rich resource, prefill via fromResponse(), mutate, PUT, and assertSame the entire serialized body; direct Identifier::fromReference() unit tests; put() cases in ClientTest; phone/lastUpdated mapping cases
• PHPStan level max: clean, zero new ignores
• ECS + Rector dry-run: clean
• Infection: exit 0 — MSI 68% (min 53.85), covered MSI 79% (min 79.25)