Updates a clinician's name, email, externalId, or roles. At least one field is required. roles replaces the clinician's assignable roles (keys from GET /organizations/{organizationId}/clinician-roles); [] leaves only clinician, and omitting roles leaves them unchanged. Roles that cannot be assigned through the API are never changed. Returns 409 for roles in an organization whose roles are managed by its identity provider.