refactor: move V2 update-authenticator rejection from pre_flight to route handler

[agentotto]

Context

In PR #820, the UpdateAuthenticatorRequest::pre_flight implementation was given a V2 guard that immediately returns a 501 MethodNotAvailable:

fn pre_flight(&self, ctx: PreFlightContext) -> Result<(), GatewayErrorResponse> {
    if ctx.registry_version == RegistryVersion::V2 {
        return Err(GatewayErrorResponse::new(
            GatewayErrorCode::MethodNotAvailable,
            "POST /update-authenticator is not supported on registry V2; use insert/remove instead."
                .to_string(),
            StatusCode::NOT_IMPLEMENTED,
        ));
    }
    ...
}

Problem

All other V1/V2 version-gating lives in the route handlers (i.e. before pre_flight is called). Placing this guard inside pre_flight means:

• Rate-limit tokens are consumed on requests that will always be rejected for V2 registries.
• The pattern is inconsistent with the rest of the codebase, making it harder to reason about where version checks happen.

Proposed Fix

Move the V2 rejection for POST /update-authenticator into the route handler, before pre_flight is invoked — consistent with how other version-specific routing decisions are made.

References

• PR fix: adhere to wip-104 in V2 registry #820: fix: adhere to wip-104 in V2 registry
• File: services/gateway/src/routes/validation.rs, around line 260