fix(api): reject non-object skill upload bodies

[dirtybits]

Summary

• make the shared skill-upload JSON parser reject malformed JSON and non-object roots as SkillUploadError client errors
• prevent POST /api/skills and POST /api/skills/[id]/versions from returning generic 500s for malformed JSON or literal null
• add table-driven regressions that prove both routes return 400 before authentication, database, SQL, or IPFS work
• add an implementation record in .agents/plans/reject-non-object-skill-upload-body.plan.md

Test Plan

• npm exec --workspace @agentvouch/web -- vitest run __tests__/api/skills-route.test.ts __tests__/api/skills-versions.test.ts --maxWorkers=1 --no-fileParallelism (40 tests)
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism (128 files / 931 tests)
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

Notes

No live database, wallet, IPFS, or browser flow was run; this change only classifies invalid upload request bodies before those dependencies are reached. The production build passed with the repository's existing ox dynamic-dependency warning and expected local missing-DATABASE_URL static-generation fallbacks.