fix(api): reject invalid raw skill ids

[dirtybits]

Summary

• reject malformed repository skill UUIDs before database initialization or PostgreSQL ::uuid casts in the shared raw-download access resolver
• preserve the existing chain- early-return handling, so raw, zip, and archive route behavior remains unchanged for chain-only listings
• replace raw-route placeholder IDs with valid UUID fixtures and add a regression proving malformed IDs invoke neither database initialization nor SQL

Test plan

• npm test --workspace @agentvouch/web -- __tests__/api/skills-raw.test.ts --maxWorkers=1 --no-fileParallelism
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

The production build passed with the existing viem Tempo dynamic-import warning and expected static-generation fallback messages because local DATABASE_URL is absent. No live chain or payment flow was run; this is request-boundary validation only.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing