API token permission and error message
### Node Version

22.13.1

### NPM/Yarn/PNPM Version

NPM 10.9.2

### Strapi Version

5.9.0

### Operating System

Docker/Podman/LXC

### Database

MariaDB

### Javascript or Typescript

Javascript

### Reproduction URL

_No response_

### Bug Description

A simple description to my application is that, it is a `Registration` form, with `relation` fields, for example, `Event`.
I have created a API token, with `custom` permission: only `create` on `registration`.
I do not want the public accessing `find` to fetch all the registration or event.

In the custom `create` controller, before saving the `registration`, I will handle some logic, such as `quota` check (max registration count).
Since `Document Service API` follows the API token permission, I use `Query Engine API` instead for these checks.
After all, I use `next()` to let Strapi handle the original creation flow.

I get error like this:

```
{
	"data": null,
	"error": {
		"status": 400,
		"name": "ValidationError",
		"message": "Invalid key Event",
		"details": {
			"key": "Event",
			"path": "Event",
			"source": "body"
		}
	}
}
```

My finding is, the `find` permission must be granted to the API token, for Strapi to run `next()`.

Following this guide https://docs.strapi.io/dev-docs/backend-customization/controllers
I have to remove `{ auth: context.state.auth }` on `validate.input` and `sanitize.input`, and use `id` instead of `documentId` on `relation` fields for the `create` to work:
```
const contentType = strapi.contentType('api::registration.registration');

try {
  await validate.input(context.request.body.data, contentType);
  const sanitized_data = await sanitize.input(context.request.body.data, contentType);

  return await strapi.db.query('api::registration.registration').create({
    data: sanitized_data,
  });
} catch (error) {
  context.throw(500, error);
}
```

Granting `find` on API token will cause data security problem.
What is the suggested way to solve my issue?

And, I would suggest stating the error is permission related, rather than being "invalid".
I thought it is due to data structure or format.

Thanks.

### Steps to Reproduce

1. Create collection `Event`
2. Create an `Event` entry
3. Create collection `Registration`, with a `relation` field with `Event`
4. Create a API token, with `custom` permission: `Registration` `create`.
5. HTTP `POST` to `Registration` with `Event` in `BODY`

### Expected Behavior

1. stating the error is due to lack of permission

### Logs

```shell

```

### Code Snippets

_No response_

### Media

_No response_

### Additional information

_No response_

### Confirmation Checklist

- [x] I have checked the existing [issues](https://github.com/strapi/strapi/issues) for duplicates.
- [x] I agree to follow this project's [Code of Conduct](https://github.com/strapi/strapi/blob/develop/CODE_OF_CONDUCT.md).