fix(settings): reject malformed retention JSON

[rissrice2105-agent]

Summary

• return a specific 400 response when disappearing-message settings contain malformed JSON
• prevent invalid request bodies from reaching database updates
• add a regression test that reproduces the previous 500 response

Validation

• focused Vitest: 7 passed
• full Vitest suite: 81 files, 483 tests passed
• focused ESLint: passed
• git diff --check: passed

Closes #241