feat(apps): Add PUT /api/v1/apps/{key} endpoint to update an existing App descriptor

Problem

There is no way to update a user-uploaded App YAML descriptor without fully deleting and re-uploading it. The current POST /api/v1/apps/ endpoint throws AlreadyExistException if the descriptor file already exists on disk, making it impossible to update an app definition in place.

This forces developers and system administrators into a fragile multi-step workaround: DELETE /api/v1/apps/{key}?removeDescriptor=true followed by POST /api/v1/apps/ — which loses all existing configuration context and is error-prone.

Goal

Expose a PUT /api/v1/apps/{key} endpoint that allows updating the YAML descriptor of an existing user-uploaded app. The key is preserved (derived from the existing filename on disk), system apps are protected, and the cache is invalidated on success.

Target Personas

• Developer teams
• DevOps teams
• System administrators (dotCMS)

Demo Expectations

In the demo, we will show:

1. An existing app visible via GET /api/v1/apps/{key}
2. A PUT /api/v1/apps/{key} call uploading a modified YAML (e.g. updated description or added param)
3. GET /api/v1/apps/{key} immediately returning the updated descriptor — no delete/re-upload needed

Acceptance Criteria

• PUT /api/v1/apps/{key} endpoint exists, consumes multipart/form-data, and requires backend authentication
• Returns 200 OK with the updated AppView on success
• Returns 404 if the app key does not exist
• Returns 403 if the target app is a system app
• The app key is preserved — overwrite uses the existing filename on disk, not the uploaded file's name
• Uploaded YAML is validated via validateAppDescriptor() before writing
• Cache is invalidated after a successful update
• Security log entry is written on successful update
• Unit and integration tests cover: happy path, system app rejection, non-existent key, invalid YAML

User Stories

• As a developer, I want to PUT /api/v1/apps/{key} with an updated YAML file, so that I can evolve my app definition without disrupting existing secrets or configurations
• As a system administrator, I want system apps to be protected from PUT updates, so that built-in integrations remain stable

Technical Scope

Changes required across 4 files:

Links

• Related bug: https://github.com/dotCMS/core/issues/34981 (DELETE returns OK but app remains visible; re-upload fails)

Start by reading AppsAPI.java, AppsAPIImpl.java, AppsHelper.java, and AppsResource.java to trace the existing app upload and retrieval flow. Run the relevant app API tests if available, then add coverage for successful updates, system-app and missing-key rejection, and invalid YAML. Done means the PUT endpoint validates and overwrites the existing descriptor, preserves its key, invalidates the cache, and records a security log.