fix(web): classify invalid JSON request bodies

[onychen]

Problem

Refs #403.

Malformed JSON, non-object JSON, and request bodies larger than the Web Host's 16 KiB command limit are recognized at the input boundary, but their ordinary Error values reach the generic dispatcher fallback and are all reported as HTTP 500. This misclassifies client input as a server failure.

Value

Clients can distinguish requests they must correct from retryable server failures. Stable machine-readable codes keep retry behavior, monitoring, and failure evidence accurate as more Web endpoints reuse the same JSON parser.

Approach

• Add a private WebRequestError at the Web Host HTTP boundary, carrying a bounded status code, stable error code, and optional byte limit.
• Return 400 INVALID_REQUEST_BODY for malformed or non-object JSON.
• Return 413 REQUEST_BODY_TOO_LARGE with maxBytes for bodies over 16 KiB.
• Keep unclassified exceptions on the existing HTTP 500 path.
• Add integration coverage through a real WebHost for all three client-input cases and an unexpected adapter failure.

Validation

• bun run check — passed (config contract, discipline ledger, Web syntax, formatting, lint, and TypeScript).
• node --test --experimental-strip-types tests/web/web-host.test.ts — passed, 21/21.
• bun run test — Web Host tests passed; repository total was 1240 passed, 2 failed, 5 skipped. Both failures were outside this change: an Antigravity stalled-body timing test passed when rerun alone, while the pre-existing Windows reused-PID setup-lock test still timed out when rerun alone.

Impact

• User-visible behavior: invalid JSON requests now receive HTTP 400, and oversized JSON requests receive HTTP 413, with stable error codes.
• Model-visible context/tools: None.
• Runtime/lifecycle: only Web Host request parsing and HTTP error projection change; Pi Session and provider lifecycles are unchanged.
• Persisted config/data: None.
• Compatibility/risk: low and scoped to correcting previously inaccurate 500 responses; unknown internal failures remain 500.