fix(team): authorise a tools edit after the existence check, not before - #764

The behavioural change — moving the conditional admin check from before the write lock to after the existence check — is covered by a real test that earns its keep. an_unknown_teammate_is_a_404_whether_or_not_tools_are_sent drives the route as a member (the only actor for whom the two orderings diverge; an admin would 404 either way and so mask the bug), and asserts both that the two bodies produce the same status and that the shared status is 404. Against the old ordering the `{ Code retrieval was unavailable (model: openrouter embeddings returned 404 Not Found: {"error":{"message":"No allowed providers are available for the selected model. Providers serving openai/text-embedding-3-small: openai, azure, but your account's allowed-providers setting permits only: deepinfra, streamlake, digitalocean. To change your allowed providers, visit: https://openrouter.ai/settings/privacy","code":404,"metadata":{"available_providers":["openai","azure"],"requested_prov), so this review saw the diff alone.

No findings.