[nicoloboschi]

Closes the two gaps left in #5540. validate_new_bank_id already guards bank create/ensure, clone and aliases.

Gap 1: whole-bank import skipped the check

submit_bank_import_async and import_bank_async created the target bank (target_bank_id, or the archive manifest's source_bank_id) without calling validate_new_bank_id. A 300-byte id or one with a newline was accepted with a 202 and the bank was created.

Fix:

• import_bank_async now calls validate_new_bank_id when the target bank does not exist yet. Every restore goes through this method: the HTTP import worker, clone, and the admin CLI import-bank. Existing banks are still never re-checked. The check runs before the restore for both include_bank_config branches.
• submit_bank_import_async makes the same call (one line) after its "already exists" check, so an HTTP caller gets a 400 at once instead of a failed background operation.

Gap 2: reserve the _ prefix

validate_new_bank_id now refuses a new bank id that starts with _. A store-owned backend that keeps its own bookkeeping objects (_index, _meta, ...) next to a bank's objects needs a part of the name space that no bank can take. Without this rule, each such backend has to invent its own escaping. Existing banks are not affected. No code or test in this repo creates a bank whose id starts with _ (I searched).

The alias request's field description (and the OpenAPI spec and generated clients that copy it) now lists the new rule.

The 192-byte cap is unchanged.

Tests

• test_document_transfer.py::test_bank_import_refuses_an_invalid_new_bank_id, run for a too-long id, an id with a newline, and a _-prefixed id. It checks that both submit_bank_import_async (HTTP) and import_bank_async (worker and CLI) raise a 400 and that no bank is created.
• test_ensure_bank_exists_optimization.py::test_invalid_new_bank_id_is_rejected_before_insert gets a new underscore-prefix case: a direct create with a _-prefixed id is a 400 and inserts no row.

Closes #5540