fix: PUT /config deep-merges nested config instead of shallow update

Replaces cfg.update(body) with _deep_merge so partial updates (e.g.
setting whisper.base_url) no longer wipe sibling keys. Also persists
the merged config back to disk via tomli_w. Adds test_put_config_deep_merges.

api/router.py

@@ -196,9 +196,14 @@ async def get_config(user: dict = Depends(current_user)):
 async def put_config(body: dict, user: dict = Depends(current_user)):
     if not user.get("is_admin"):
         raise HTTPException(status_code=403, detail="Nur Administratoren können die Config ändern")
+    from config import _deep_merge, CONFIG_PATH
+    import tomli_w
     cfg = load_config()
-    cfg.update(body)
-    return cfg
+    merged = _deep_merge(cfg, body)
+    os.makedirs(os.path.dirname(CONFIG_PATH), exist_ok=True)
+    with open(CONFIG_PATH, "wb") as f:
+        tomli_w.dump(merged, f)
+    return merged
 
 
 @router.post("/open")