fix(api): validate Stripe checkout skill IDs

[dirtybits]

Summary

• validate nonempty Stripe checkout skillId values with the repository's existing UUID boundary helper before any checkout-side work
• return 400 { error: "Invalid skillId" } instead of allowing malformed IDs to reach the database ::uuid cast and generic 500 handling
• add a regression proving malformed IDs do not invoke rate limiting, wallet authentication, database initialization/querying, or Stripe session creation
• update the Stripe test fixture to a valid v4 UUID and record the focused execution in .agents/plans/validate-stripe-checkout-skill-id.plan.md

Test Plan

• npm test --workspace @agentvouch/web -- __tests__/api/stripe-routes.test.ts --maxWorkers=1 --no-fileParallelism (52 tests)
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism (128 files / 928 tests)
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

Notes

No live Stripe checkout, card payment, database, wallet, or deployment flow was run. The webpack build passed with the repository's existing ox/viem dynamic-dependency warning and expected static-generation fallback logs because local DATABASE_URL is absent.