I spent a bit of time trying to figure this out. No luck yet, but the best clue I have so far is the multipart form data sent by the observation edit page (https://www.inaturalist.org/observations/{observation_id}/edit). Open up your dev console, edit an observation, and take a look at the request it sends. It uses the older observation endpoint (POST https://www.inaturalist.org/observations/{observation_id}), and includes:
Content-Disposition: form-data; name="_method"
patch
I see that _method parameter mentioned in the API docs, but it doesn’t mention patch as a valid value, or that you can POST to that endpoint.
Anyway, for existing photos on the observation, you’ll see the site sends form fields like:
Content-Disposition: form-data; name="local_photos[{observation_id}][]"
{photo_id}
I tried a bunch of different variations of endpoints, HTTP methods, and formats of specifing local_photos with a photo ID in form data, request parameters, and JSON body, but no luck yet. It’s also possible that this can only be used to remove existing photos from an observation, not add new ones. See the note on the ignore_photos parameter in the API docs