feat(api): client-side request guards matching server validation (circles name, assignments non-empty, timetable lessongroups) #75

Description

Three client methods accept payloads the server will always reject, discovered during the PR #70 sweep against campus weekly:

1. Circles: PATCH /circles/<id>/ requires name (description optional). Circles.Circle.update(**updates) accepts anything → surprise 422. Give it an explicit signature or guard, and consider exposing members PATCH (upsert access_value) — only add/remove exist today.
2. Assignments: PATCH /assignments/<id>/ rejects empty bodies (InvalidRequestError("Empty request body")). Assignments.Assignment.update(**updates) can send {}. Mirror Submissions.Submission.update()'s "at least one field" ValueError.
3. Timetable: POST /timetable/ 400s unless data contains the key lessongroups (using lesson_groups gets a rename suggestion in the error). Timetables.new() passes data through blindly — at minimum a docstring warning; a keyword-only guard would be better.

All three are client-side validation only; no server changes.