Handle malformed login request bodies

[morganschp]

Summary

• parse login request bodies with the existing safe JSON helper
• return 400 Invalid request body for malformed, empty, or non-object JSON
• add a regression test proving malformed JSON does not call Supabase sign-in

Fixes #190

uGig task

Submitted for the active uGig repo testing task: https://ugig.net/gigs/4741218f-a723-46bb-82cb-6516120331ae

No payout details included; those can be provided after acceptance.

Tests

• ./node_modules/.bin/vitest run src/app/api/auth/login/route.test.ts
• ./node_modules/.bin/eslint src/app/api/auth/login/route.ts src/app/api/auth/login/route.test.ts
• ./node_modules/.bin/tsc --noEmit
• git diff --check -- src/app/api/auth/login/route.ts src/app/api/auth/login/route.test.ts