List personas (v2)

Updates the persona linked to a user. Carries every caveat of PUT /v1/personas/{persona_id} — no validation, and Updates(struct) skips zero values so active: false and empty strings do nothing — plus two of its own. THE LINK IS RESOLVED FROM THE CALLER'S OWN RECORD GRANTS, NOT FROM THE PATH USER'S LINKS. The handler calls links.FetchLinksByType with the AUTHENTICATED CALLER's id and canReadAll hardcoded to false, so it sees only links touching a user record the caller — or one of the caller's roles — holds a row for in rbac.record_permissions. rbac.RecPermission, which guards the route, returns true for an Administrator without consulting that table at all, so an Administrator passes the permission check and then finds no links: the caller must hold an explicit record grant on the user in the path for this route to resolve anything. IT ONLY WORKS WHEN EXACTLY ONE LINK TOUCHES THAT USER. The ids collected from those links are bound to "id = ?", which GORM expands as a parenthesised list: one id gives id = ($1) and updates that row; none gives id = (NULL), which matches nothing; two or more gives id = ($1,$2), which PostgreSQL rejects as a comparison against a row constructor. Every failure lands in the same branch and answers 404 having written nothing. The collected ids are not filtered by record type either — the customer-to-user and signatory-to-user links other modules create count toward the same total, and a single one of them can be handed to First() in place of the persona, which then finds no persona row and also answers 404.