Update instance ports from the CLI

[callen-bot]

Summary

• add brev ports update <instance-or-node> with an edit alias
• select a mapping interactively or target its stable port_id with --id
• update destination ports and source CIDRs, including clearing restrictions with --allow-anywhere
• update HTTP origin protocol and public/authorized access policy
• support managed instances and registered nodes with human-readable or JSON output using the stack-wide schema without kind
• mark brev ports update as beta and hide it from help and completion

Why

The UI performs these mutations in place. Modeling update as close plus create would introduce downtime and could change the mapping ID, endpoint, or allocated public port.

Impact

Users and automation can change all port fields exposed by the UI while preserving the existing mapping identity and public endpoint. Multiple field groups use separate API mutation RPCs in documented order and are not transactional.

Visibility

The brev ports command family is intentionally hidden from help and completion while its final naming and nesting are being discussed, including whether it should use a different name or live under a network-oriented parent. Exact commands remain callable so the implementation can be tested. This PR hides update and inherits the hidden group, list, create, and close commands from the earlier stack layers.

Stack

• Add ports command for instances and nodes #441: read/list operations via brev ports ls
• Create instance ports from the CLI #442: create operations via brev ports create
• Close instance ports from the CLI #446: delete/close operations
• This PR: update/edit operations

Validation

• go test ./pkg/cmd ./pkg/cmd/ports
• go test -race ./pkg/cmd/ports ./pkg/cmd
• make fmtcheck vet lint
• go build -o /tmp/brev-port-restack-full-brev .
• help smoke tests confirm the complete ports command family remains hidden but callable explicitly