A shop can be renamed and, while empty, removed - from head office

The display name was always meant to be editable and the slug frozen;
until now neither had a way in. PATCH /api/sites/{site} takes a name
and a timezone (manager and above), DELETE removes an empty shop
(owner). The shop drawer in head office gets both, with the short name
shown read-only and the reason beside it.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KGcjxF1cNLcuwc3DAPcnfj

server/internal/api/sites_test.go

@@ -108,3 +108,22 @@ func TestNoBrokerConfiguredSaysSo(t *testing.T) {
 		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
 	}
 }
+
+func TestAManagerRenamesAShopButTheSlugStays(t *testing.T) {
+	s, fs := newServer(t)
+	seedUser(fs)
+	seedSite(fs)
+	sess := login(t, s, "manager@acme.com", "correct horse battery")
+	rec := do(t, s, "PATCH", "/api/sites/chennai", sess.Token, map[string]any{"name": "TeNext Coimbatore"})
+	if rec.Code != http.StatusOK {
+		t.Fatalf("got %d: %s", rec.Code, rec.Body.String())
+	}
+	var out SiteHealth
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	if out.Name != "TeNext Coimbatore" || out.Slug != "chennai" {
+		t.Fatalf("renamed wrong: %+v", out)
+	}
+	if rec := do(t, s, "PATCH", "/api/sites/chennai", sess.Token, map[string]any{"timezone": "Mars/Olympus"}); rec.Code != http.StatusBadRequest {
+		t.Fatalf("bad timezone accepted: %d", rec.Code)
+	}
+}