Handle malformed wallet zap bodies

[morganschp]

Summary

• return 400 Invalid request body for malformed or non-object wallet zap JSON
• keep valid JSON payloads on the existing Zod validation path
• add route tests proving malformed bodies stop before service-client, wallet, or transfer work

Fixes #188

uGig task

Submitted for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae

No payout details included; those can be provided after acceptance.

Tests

• ./node_modules/.bin/vitest run src/app/api/wallet/zap/route.test.ts
• ./node_modules/.bin/eslint src/app/api/wallet/zap/route.ts src/app/api/wallet/zap/route.test.ts
• ./node_modules/.bin/tsc --noEmit
• git diff --check -- src/app/api/wallet/zap/route.ts src/app/api/wallet/zap/route.test.ts