Ensure exceptions contain only hashed tokens, and ensure exceptions are logged for JSONRPC endpoints

Problem/Motivation

Claude Opus 4.8 identified the following issue:

Uncaught exceptions bypass sanitized JSON-RPC error path

  AddPushToken::execute() (.../Method/AddPushToken.php:81) only catches \LogicException. But:
  - registerOrRefreshToken() throws PushNotificationsRegistrationTokensException (extends \Exception, not
  \LogicException) in its "too many tokens" / "unable to load" branches.
  - RegistrationToken::preSave() throws PushNotificationsRegistrationTokensInvalidArgumentException — despite the name
  it extends the base \Exception, not PHP's \InvalidArgumentException — when the owner is anonymous/unset.

  Neither is caught, so the deliberate Error::internalError() (sanitized) path is bypassed and the raw exception
  propagates to the JSON-RPC handler, potentially surfacing internal messages. Catch \Throwable (or the module base
  exception) as well, then return internalError().

Let's fix it.