fix: PUT /config deep-merges nested config instead of shallow update

Replaces cfg.update(body) with _deep_merge so partial updates (e.g.
setting whisper.base_url) no longer wipe sibling keys. Also persists
the merged config back to disk via tomli_w. Adds test_put_config_deep_merges.

tests/test_api.py

@@ -144,3 +144,24 @@ def test_audio_combined_forbidden_for_non_admin():
         assert r.status_code == 403
     finally:
         app.dependency_overrides.pop(current_user, None)
+
+
+def test_put_config_deep_merges(tmp_path, monkeypatch):
+    import config as cfg_mod
+    monkeypatch.setattr(cfg_mod, "CONFIG_PATH", str(tmp_path / "config.toml"))
+    from main import app
+    from api.router import current_user
+    app.dependency_overrides[current_user] = lambda: {"username": "u", "output_dir": "/tmp", "is_admin": True}
+    try:
+        from fastapi.testclient import TestClient
+        client = TestClient(app)
+        r = client.put("/config",
+                        json={"whisper": {"base_url": "http://beastix:8000"}},
+                        headers={"Authorization": "Bearer fake"})
+        assert r.status_code == 200
+        data = r.json()
+        # base_url updated, model preserved
+        assert data["whisper"]["base_url"] == "http://beastix:8000"
+        assert data["whisper"]["model"] == "large-v3"
+    finally:
+        app.dependency_overrides.pop(current_user, None)