secrets: a bad secrets block is a 400 from the typescript create route

Resolving pointers inside configToWorkspaceArgs put SecretsError and
ZodError behind the router's resource-build catch, which answers 502.
Python's create route catches both to 400, and the clone route in this
same file already guards for it.