feat(prompts): validate template syntax on the REST update endpoint

The GraphQL createPrompt/updatePrompt mutations run validator.ValidatePrompt
(Go text/template parse + declared-variable check + trial render), but the
REST PUT /prompts/:type handler only checked the field was present, so a
prompt with a syntax error or an undeclared variable could be stored over
REST and later break rendering. Mirror the GraphQL check in PatchPrompt.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/pkg/server/services/prompts.go

@@ -10,6 +10,7 @@ import (
 	"pentagi/pkg/server/rdb"
 	"pentagi/pkg/server/response"
 	"pentagi/pkg/templates"
+	"pentagi/pkg/templates/validator"
 
 	"github.com/gin-gonic/gin"
 	"github.com/jinzhu/gorm"
@@ -208,6 +209,10 @@ func (s *PromptService) PatchPrompt(c *gin.Context) {
 		logger.FromContext(c).WithError(err).Errorf("error validating prompt type '%s'", promptType)
 		response.Error(c, response.ErrPromptsInvalidRequest, err)
 		return
+	} else if err = validator.ValidatePrompt(templates.PromptType(promptType), prompt.Prompt); err != nil {
+		logger.FromContext(c).WithError(err).Errorf("error validating prompt template '%s'", promptType)
+		response.Error(c, response.ErrPromptsInvalidRequest, err)
+		return
 	}
 
 	privs := c.GetStringSlice("prm")