internal/router: implement PUT for meta endpoints

This also adds the notion of a multi-error, adding a new field to the Error
type.
Is this a 500? Can we return a method not allowed status (or alternatively add a TODO and a card)?