gateway: Add PATCH /config support

[doanac]

Fixes issue #242

[doanac]

@mike-scott - this should fix your issue

[mike-scott]

I'll test this in the morning. Looks great!

[mike-scott]

I verified this works on real HW:

• iq-9075-evk running qli-2.0 with Foundries components
• registered to the latest main + this patchset
• logged attempts for PATCH /config returned 201

[mike-scott]

• I didn't see any glaring security holes
• code looks reasonable for handling wireguard and remote-actions (though I'm not that familiar with the code base)

[mike-scott]

Claude seems to think we should take a look at the following:

• Two findings look like blockers. The nil-map panic (handlers_config.go:68) is reachable from an operator PUT with "Files": null and then wedges every subsequent device PATCH. And ConfigCreate drops the public-key field the real fioconfig client sends on first boot — the review verified this against upstream fioconfig source — which silently breaks config encryption for devices whose config key differs from their TLS key.
• A cluster of four findings shares one cause: the gateway path re-implements the config write at handler level and misses the UI path's purge, no-change dedup, and locking. Since fioconfig PATCHes on every check-in, the missing dedup plus never-purged history means device-controlled unbounded journal/blob growth. The last finding suggests how to fix it is: one storage-level PatchDeviceConfig primitive both APIs share, which addresses the race, purge, and dedup together.