fix(api): normalize non-object JSON bodies to empty dict in token PATCH

[michaelxer]

Summary

The /api/tokens/{token_id} PATCH route catches JSON parse failures and falls back to {}, but after a successful parse it assumes the payload is a mapping. Valid non-dict JSON (e.g. [] or null) reaches payload.get(...) and raises AttributeError, returning an unhandled 500 to the client.

Add a type check after parsing: if the payload is not a dict, normalize it to {} so the route treats it as an empty update body.

Target branch

• This PR targets dev, not main. All PRs land in dev; main is curated by the maintainer at each release. If your PR is on main by accident, click "Edit" on this PR and change the base.

Linked Issue

Fixes #3966

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.

How to Test

1. Run the app on current dev and authenticate as admin.
2. Create or select an existing API token.
3. curl -X PATCH http://localhost:PORT/api/tokens/TOKEN_ID -H "Content-Type: application/json" -d "[]" — should return the token unchanged (currently returns 500).
4. Repeat with -d "null" and -d "\"hello\"" — same result.
5. A normal dict body like -d '{"name":"test"}' should still work as before.

[alteixeira20]

Thanks for the small targeted fix. The implementation direction looks correct, but I would like this to include focused regression coverage before approval.

The linked issue asks specifically for coverage of valid non-object JSON bodies reaching the PATCH route, especially [] and null. Right now the PR only changes routes/api_token_routes.py, so the behavior is fixed in code but not protected against regression.

Please add focused tests, preferably in tests/test_api_token_routes.py, covering:

• PATCH /api/tokens/{token_id} with body [] does not raise a 500;
• PATCH /api/tokens/{token_id} with body null does not raise a 500;
• the normal object body path still behaves as before.

After that I can re-run the focused audit and merge if everything stays green.

[michaelxer]

All three regression tests are pushed and CI is green. Ready for re-review when you get a chance.

[alteixeira20]

LGTM. Re-audited the current head after the requested regression coverage was added. The fix is narrowly scoped to normalizing valid non-object JSON payloads on the API token PATCH route, and the added tests cover [], null, and the normal object update path. The merge probe is clean, GitHub checks are green, changed-module compile passed, and git diff --check passed. The local test_security_regressions.py failures are unrelated to this PR and caused by a missing local nh3 dependency.