[ECW-9115] docs: document ICANN contact updates on registered domains

[sudoryan]

What/Why/How?

ECW-9115 was raised as "Reseller/Partner API has no endpoint to update ICANN contacts on existing domains". Investigating the gateway showed the endpoint already exists and is already exposed to partners — PATCH /domains/{name}/dns/contacts is in the reseller OpenAPI spec, DOMAIN_ICANN_CONTACT_UPDATE is in the default partner permission set, and E2E coverage exercises it against an active REGISTERED domain.

The real gap was this guide. It described the registrant as "Set during registration via the owner field" and its update example showed only admin/tech/billing. A partner reading it reasonably concludes a wrong registrant is permanent — which is exactly the situation in the originating support ticket, where a reseller's domains carry incorrect registrant emails and ICANN verification notices reach the wrong party.

Changes to apis/reseller/implementation-guide.md:

• owner added to the update example, and the section retitled to say plainly that all four roles can be changed after registration.
• Mechanics documented: omitted roles are left unchanged, each role takes an existing id or inline fields, $preview=true validates without applying, and the returned operation must reach a terminal state before the change is complete.
• No bulk form — stated explicitly, since correcting many domains currently means one request per domain.
• New section on registrant changes and reverification. For a tokenized domain pending ownership verification: owner becomes required, omitted roles default to the new registrant, DNS records may be cleared per the domain's retention mode, and the domain reports registration.icann.ownershipVerification: REVERIFICATION_REQUIRED — during which DNS calls fail with UNVERIFIED_DNS_REGISTRANT (400).

Every claim was verified against the gateway implementation rather than the previous docs text.

Reference

• ECW-9115

Testing

Documentation only — no code paths changed. Behaviour described was verified against registrar-platform (icann-contact-operation.provider.ts, domains-dns-contacts.controller.ts, operation.error.filter.ts) and against the generated reseller OpenAPI spec.

Check yourself

• Code is linted
• Tested
• All new/updated code is covered with tests

Security

• Security impact of change has been considered
• Code follows company security practices and guidelines

Note: apis/reseller/openapi.yaml is intentionally untouched — it is generated from registrar-platform's cli/openapi/clean-reseller-spec.mjs, so schema-level wording belongs in that repo. A separate defect found there is described in the ECW-9115 thread.