UniqueField not validated with JSON-RPC

Problem/Motivation

Identified by Fable:

3. Entity validation never runs on the JSON-RPC path — the UniqueField constraint is dead code there, and there's a
  permanent-DoS race.
  ProcessTokens calls ->save() without ->validate(), so neither UniqueField nor the 512-char length constraint is enforced
  (there is no DB unique index on token either — uniqueness rests entirely on the pre-save query at
  ProcessTokens.php:47). Two concurrent registrations of the same token create duplicates; afterwards
  registerOrRefreshToken() throws "Too many tokens" forever for that token, and the client can never register or refresh
  it again. An overlong token also reaches PostgreSQL and fails at the DB layer, returning internalError instead of
  invalidParams. Recommend: unique index on the token column (or validate + handle violations), a maxLength on the
  JSON-RPC token parameter schema, and self-healing (e.g., delete duplicates) instead of throwing when count > 1.