Better handle invalid inputs

[eheikes]

Check for and stop bad input before it can affect database operations.

This also fixes two other problems:

• ?replace=true used to delete data on bad input. It deleted the existing item before inserting the new one, so a typo in a label removed the old item and then failed. The checks now run before the delete.
• Updates used to be half-applied. An update with a bad label saved the other fields and cleared the item's labels before failing. Now nothing changes.

Duplicate labels (e.g. ['work', 'work']) were also a 500, from a primary-key clash. They're now ignored, in both the database and the response, rather than rejected.