fix(api): normalize skill PATCH request bodies

[dirtybits]

Summary

• normalize literal null PATCH bodies to the route's existing missing-fields 400 contract
• return a client-error 400 for malformed PATCH JSON instead of leaking it through the outer 500 handler
• add regressions proving both inputs stop before database, signature, and chain work

Test plan

• npm run format:check
• npm run lint --workspace @agentvouch/web
• npm run typecheck --workspace @agentvouch/web
• npm run test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism
• npm exec --workspace @agentvouch/web -- next build --webpack

Notes

• The webpack build passed. It emitted the repository's existing dynamic-dependency warning from ox/viem, and expected local build-time fallbacks because DATABASE_URL is absent.