fix(team): authorise a tools edit after the existence check, not before - #764

The reorder correctly fixes the 404-vs-403 inconsistency for unknown ids: the existence (404) check now precedes the conditional admin check, so a member sending {"tools": ...} to a missing agent gets 404 like any other body. The test is well-constructed (member actor, unknown id, both payloads) and would fail against the old ordering while passing against the new one. One residual concern: the admin check now runs while the company write lock is held, which the original comment explicitly wanted to avoid; this is only a problem if require_admin is non-trivial, which can’t be determined from this file. No correctness bug in the change itself is apparent. Code retrieval was unavailable (model: openrouter embeddings returned 404 Not Found: {"error":{"message":"No allowed providers are available for the selected model. Providers serving openai/text-embedding-3-small: openai, azure, but your account's allowed-providers setting permits only: deepinfra, streamlake, digitalocean. To change your allowed providers, visit: https://openrouter.ai/settings/privacy","code":404,"metadata":{"available_providers":["openai","azure"],"requested_prov), so this review saw the diff alone.

No findings.