Take the allow-list entry id from the path, not the request body, on update

## Objective

PATCH /v2/app-config-allow-list/{id} currently carries the id in both the path and the request body. The handler merges the path id into the body via model_copy(update={id: ...}), so the body id is silently overwritten. Drop id from UpdateAppConfigAllowListInput and pass the path id to the adapter directly, matching the id/data split the api-guide skill prescribes for update.

## Why

- model_copy bypasses Pydantic v2 re-validation.
- OpenAPI advertises id as a required body field the handler always discards; a mismatched body id is ignored without error.
- api-guide prescribes update_user(id, data) — id identifies the item, data holds the changes; id does not belong in the body DTO. app_config_fragment already follows this.

## Acceptance Criteria

- UpdateAppConfigAllowListInput no longer has an id field.
- The handler passes the path id to adapter.admin_update(id, input); no model_copy.
- Client SDK and CLI stop sending id in the body; id goes in the URL only.
- OpenAPI regenerated; the update body no longer lists id.

## Related

Same fix already applied to app_config_fragment in BA-6921. The other A-pattern entities (model_card, runtime_variant, runtime_variant_preset, deployment_revision_preset, retention_policy) share this issue but are out of scope here.

JIRA Issue: BA-6970

Read UpdateAppConfigAllowListInput and the PATCH handler, then compare them with the already-fixed app_config_fragment pattern. Trace adapter.admin_update(id, input) and the client SDK and CLI update calls; done means the id is URL-only, the body schema and generated OpenAPI omit it, and the related update path no longer uses model_copy.

Written by the indexing model from the issue text.