fix(api): normalize invalid x402 request bodies

[dirtybits]

Summary

• normalize malformed JSON and literal null bodies to {} in the authenticated x402 verify and settle endpoints
• preserve the established missing-proof 400 contract instead of returning 500 before validation
• add four no-side-effect route regressions covering malformed and literal-null bodies across both endpoints
• record implementation and verification in .agents/plans/normalize-x402-invalid-json-bodies.plan.md

Test plan

• npm test --workspace @agentvouch/web -- __tests__/api/x402-routes.test.ts --maxWorkers=1 --no-fileParallelism
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism (126 files, 908 tests)
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

The webpack build passed with the existing viem Tempo dynamic-import warning and expected static-generation database fallbacks because local DATABASE_URL is absent. No live Base/Solana x402 transaction was run; this change rejects invalid request input before payment verification or settlement helpers execute.