Validate template group removal requests - #5358

Summary

• Require Template Group removal to use the expected POST request method.
• Reject missing or malformed group identifiers before model lookup.
• Add sanitized controller coverage for rejected and valid removal behavior.

Root cause

The removal controller relied on the Control Panel form shape without enforcing its request method or identifier requirements at the controller boundary.

Impact

Requests outside the intended removal flow are rejected before model lookup, while valid name- and ID-based Control Panel removals retain their existing site and permission checks.

Validation

• Focused Group controller suite: 9 tests, 40 assertions
• Current Design controller suite: 19 tests, 53 assertions
• PHP syntax checks for both changed files
• git diff --check
• Independent review found no actionable issues