fix(api): normalize purchase verification request body

[dirtybits]

Summary

• normalize literal JSON null to an empty request body in POST /api/skills/[id]/purchase/verify
• reject empty/null or malformed request bodies before database initialization, SQL, or purchase-verification helpers run
• preserve Base existing-purchase verification, which may omit a transaction reference when buyer and listing data are supplied
• add no-side-effect regressions for literal-null and malformed JSON bodies
• document the focused implementation and verification in .agents/plans/normalize-purchase-verify-body.plan.md

Test plan

• npm test --workspace @agentvouch/web -- __tests__/api/skills-purchase-verify.test.ts --maxWorkers=1 --no-fileParallelism
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

The webpack build passed with the existing viem Tempo dynamic-import warning and expected static-generation database fallbacks because local DATABASE_URL is absent. No live purchase-verification flow was run; this is route-boundary hardening only.