Partially update a saved reply. Only the fields supplied in the body are written.

Visibility:

• isPrivate: true → set userId to the OAuth session's user, clear roles.
• isPrivate: false → clear userId; if roles is supplied, persist it.
• roles (without isPrivate) → persist roles; if non-empty, also clear userId.

Returns 404 when the reply does not exist, has been soft-deleted, or is not visible to the OAuth session.