Reject NUL characters in playlist names and proposal titles with a 400

[rowkav09]

Same class as #215. The playlist generation name and the playlist proposal title are stored in Postgres, which cannot hold NUL, so a payload containing \u0000 passed validation and answered 500. Both schemas now refuse NUL, so the request gets the existing 400 INVALID_REQUEST before any query. The shared check moves to packages/contracts/src/text.ts and the scrobble schema uses it too. Test: two cases fail with 500 on main and pass with 400, asserting the database is never called. Behaviour change: invalid payloads return 400 instead of 500.

[rowkav09]

Reviewed head 643d2a0 (on main 8c5cdc8, which has #215). Approved.

All 54 test files and 365 tests pass. Both new route tests fail against main's schemas. I sent 16 payloads through the real routes, with a mocked database, on main and on this head. The changes:

• /playlists/generate with a NUL in name, plain or space-padded, now returns 400 INVALID_REQUEST with no query run.
• /playlists/proposals with a NUL in title is the same.

These are unchanged from main:

• Valid generate bodies (named, unnamed, unicode) still reach the seed lookup.
• An empty generate name is still a 400.
• Valid proposals (with a title, without one, with limit) still reach candidates.
• The Reject NUL characters in scrobble imports with a 400 #215 scrobble checks: NUL in artistName, trackTitle or albumTitle is still a 400 with no query run, and valid scrobbles (with an album, without one, with an empty one) still reach the import. The shared noNul is the same function, and text.ts has no imports, so there is no import cycle.

CI at the time I checked: CodeFactor and ghostdeps were green, and the TypeScript workspace job was still running, so it is not CI-green yet.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!