Git token PUT returns 500 with a raw error for an invalid token id or a missing request body #8854

Summary

PUT /api/v1/teams/:teamId/git/tokens/:tokenId (and the DELETE on the same path) answers malformed input with 500 { "error": "unknown_error", "message": "<exception text>" }, instead of 400 or 404. This error body also uses error for the code and message for the text, unlike the 400 and 404 replies in the same file, which use code and error.

Steps to reproduce

1. As a team owner on a team with git integration, PUT /api/v1/teams/<teamId>/git/tokens/not-a-hashid!! with { "name": "a" }. It returns 500 with the message Error: The provided ID (not-a-hashid!!) is invalid, as it contains characters that do not exist in the alphabet (...), which exposes the hashid alphabet.
2. PUT a valid token id with no request body. It returns 500 with the message TypeError: Cannot read properties of undefined (reading 'name').
3. PUT a valid token id with { "name": "" } or {}. It returns 200 and changes nothing, with no hint that the name was ignored.
4. PUT with { "name": { "a": 1 } } returns 500 SequelizeValidationError. PUT with { "name": 5 } returns 200 and stores the number.

Expected

1. An undecodable token id returns 404 not_found, as an unknown id does.
2. A missing body or a non-string name returns 400 invalid_request. An empty name could also be rejected rather than silently ignored.
3. The route declares a body schema so these are rejected by validation.

Reference

forge/ee/routes/gitops/index.js:82-99 has no schema, calls GitToken.byId (forge/ee/db/models/GitToken.js:34-46, decodeHashid throws) inside a catch-all that replies 500, and guards the update with request.body.name &&. The same byId path affects the DELETE at :65-80.