Strapi update username from custom controller

I am trying to create a custom controller to update the user profile.

I created the routing file and the corresponding controller.

Routing file: server/src/api/profile/routes/profile.js

module.exports = {
  routes: [
    {
      method: 'GET',
      path: '/profile',
      handler: 'profile.getProfile',
    },
    {
      method: 'PUT',
      path: '/profile',
      handler: 'profile.updateProfile',
    },
  ]
}

Controller: src/api/profile/controllers/profile.js

async updateProfile(ctx) {
    try {
        const { id } = ctx.state?.user;

        const user = strapi.query('admin::user').update({
            where: { id },
            data: {
                username: "testUsername"
            }
        })

        ctx.body = "User updated"
    } catch(error) {
        ctx.badRequest("Something went wrong", { error })
    }
},

The above code returns "User updated", but the username does not update. I am executing the PUT call with a correct Bearer authorisation token and the user permissions for that user are set to enable "updateProfile".

Oddly enough, the same code, when changed to update a different API item, works perfectly fine:

async updateArticle(ctx) {
    try {
        const { id } = ctx.state?.user;

        const article = strapi.query('api::article.article').update({
            where: { author: id },
            data: {
                title: "New title"
            }
        })

        ctx.body = article
    } catch(error) {
        ctx.badRequest("Something went wrong", { error })
    }
},

I am also confused by different syntaxes appearing in the official Strapi documentation, for example some docs mention:

strapi.query('admin::user').update({ id }, data)

But in other places in the documentation its:

strapi.plugins['users-permissions'].services.user.update({ id });

And then elsewhere:

strapi.query('user', 'users-permissions').update(params, values);

Another question is: do I need to sanitise the input / output in any way? If yes, how? Importing sanitizeEntity from "Strapi-utils" doesn't work, but it's mentioned in several places on the internet.

Additionally, I cannot find a list of all ctx properties. Where can I read what is the difference between ctx.body and ctx.send?

The lack of good documentation is really hindering my development. Any help with this will be greatly appreciated.