Config server returns 500 instead of 422 when it rejects a configuration

## StatGPT SDMX Proxy version

development

## Short description

The config server answers `POST /config` with HTTP 500 when `ConfigValidator` rejects the submitted
configuration, so clients cannot distinguish an invalid payload from a server-side failure. It
should answer 422 with the validation message.

## What steps will reproduce the bug?

1. Start the config server (any `CONFIG_SERVER_SOURCE_TYPE`).
2. `POST /statgpt/sdmx-proxy-config-server/api/v0/config` with a configuration that fails
validation — for example an agency whose `primaryRegistry` names a registry that is not in
`configs`.
3. Inspect the response status and body.

## What is the expected behavior?

HTTP 422 with the reason in the body, in the same shape `ApiKeyAuthFilter` already uses:

```json
{"message": "Agency 'IMF' references unknown registry 'UNKNOWN'. Available registries: [...]", "status": 422}
```

The `@ApiResponse` annotations on `ConfigServerApi.updateConfig` should be updated to declare 422
instead of the 400 they advertise today.

## What do you see instead?

Spring's default error representation, with the validation message available only in the server log:

Response

```json
{
"timestamp": "2026-07-31T14:02:11.482+00:00",
"status": 500,
"error": "Internal Server Error",
"path": "/statgpt/sdmx-proxy-config-server/api/v0/config"
}
```

## Additional information

Root cause: `ConfigValidator` signals rejection with `IllegalArgumentException`, and the config
server module has no exception handler. `GlobalExceptionHandler` exists only in the `sdmx-proxy`
module, which `sdmx-proxy-config-server` does not depend on, and
`ConfigServerApplication` restricts scanning to `com.epam.sdmxproxy.configserver` — so it is never
applied.

Proposed fix: add a `@RestControllerAdvice` in the `configserver` package mapping
`IllegalArgumentException` to 422, leaving genuine storage-write failures as 500.

Impact on consumers: the StatGPT backend admin portal now lets operators edit this configuration and
forwards their edits to `POST /config`. It surfaces a validation rejection to the user and treats
other failures as infrastructure problems, which it cannot do while both share status 500 — an
invalid edit is reported to the operator as saved.

Start with ConfigServerApi.updateConfig, ConfigValidator, and the package scanning in ConfigServerApplication; compare the response shape with ApiKeyAuthFilter and review GlobalExceptionHandler in the sdmx-proxy module. Reproduce a rejected configuration against POST /config, then verify validation failures return HTTP 422 with the message while storage-write failures remain 500, and update the API annotations accordingly.

Written by the indexing model from the issue text.