Prevent repo rename/move via the path-less /move and /copy endpoints

## What

`POST /move/{org}/{repo}` and `POST /copy/{org}/{repo}` with no path under the repo act on the whole repo. That is a repo rename or move. It sweeps every key in the repo, including version and audit history under `.da-versions`.

This form is not in the API docs. The docs say move and copy take a path. The da.live UI reaches it too: at the org level you can hit rename on a repo, and it runs.

## Why prevent it

The blast radius is large and easy to trigger by accident from the UI.

Version history does not move cleanly. The moved history keeps pointing at the old repo. With #303 blocking `.da-versions` destinations, a repo-root move now drops version history instead of carrying it.

## Proposed fix

Reject a repo-root move or copy, a request whose source is the repo root with no sub-path. Return a 4xx. This is the authoritative gate. It covers every client: the da.live browse UI, Experience Workspace, and direct API calls.

Removing the matching repo rename action in the da.live UI is the companion issue: adobe/da-live#1121.

Start by locating the handlers for POST /move/{org}/{repo} and POST /copy/{org}/{repo}, then inspect how requests with no repository sub-path are currently handled. Add coverage for rejecting repo-root move and copy requests with a 4xx while keeping path-specific operations working. The da.live UI rename action is tracked separately in adobe/da-live#1121.

Written by the indexing model from the issue text.