Security: Sanitize user input before passing to PUT /projects/{id}

[nourshoreibah]

Problem: The entire parsed request body is passed to .set(body) without any validation or field whitelisting. An attacker could overwrite any column in the projects table, including project_id or created_at.

Update this endpoint to sanitize the input first to prevent attacks