fix(web): reject invalid backtest JSON bodies

[rissrice2105-agent]

Summary

• reject malformed and non-object JSON bodies before reading backtest options
• return HTTP 400 for valid null bodies instead of throwing a TypeError
• prevent malformed JSON from falling through to a potentially expensive default backtest

Tests

• vitest run src/app/api/backtest/route.test.ts (15 passed)
• full @b1dz/web Vitest suite (96 passed)
• tsc --noEmit

Closes #26