fix(team): authorise a tools edit after the existence check, not before - #764

The description accurately matches the diff. The PR moves the conditional require_admin check for tools from before the existence lookup to after it, so an unknown id returns 404 regardless of whether tools is present, and adds a test (an_unknown_teammate_is_a_404_whether_or_not_tools_are_sent) that drives this as a member and asserts both responses match and equal 404. The description's explanation of the defect, the invariant, and why the ordering is forced all correspond to what the code and comments actually do. No discrepancies found. Code retrieval was unavailable (model: openrouter embeddings returned 404 Not Found: {"error":{"message":"No allowed providers are available for the selected model. Providers serving openai/text-embedding-3-small: openai, azure, but your account's allowed-providers setting permits only: deepinfra, streamlake, digitalocean. To change your allowed providers, visit: https://openrouter.ai/settings/privacy","code":404,"metadata":{"available_providers":["openai","azure"],"requested_prov), so this review saw the diff alone.

No findings.