Replaces protocol, authByInvite, anonymizeUsers and redirectUrl, and merges the supplied config over the stored one.

Notes that matter in practice:

• Send the masked secret back unchanged to keep it. A config.clientSecret starting with *** is dropped before the merge, so the stored secret survives. Sending a real value replaces it.
• Because config is merged rather than replaced, keys you omit keep their previous values.
• Low-tier plans get 403; this check is not the same as the Enterprise-only check on create.
• 404 when the workspace has no integration yet.