Reject invalid refund amounts before automatic action

[vsolano9]

What & why

The refund guardrail currently auto-resolves zero and negative values, and treats non-finite values as ordinary over-limit refunds. This validates the amount before any automatic action so malformed triage output is routed to a human with a clear reason.

Closes #3

Changes

• require refund amounts to be finite and greater than zero before auto-resolution
• escalate invalid values without claiming they merely exceed the configured limit
• add focused policy coverage for valid below/at/above-limit, zero, negative, non-finite, and missing amounts
• expose the test suite through npm test without adding dependencies

Validation

• npm test — 4/4 pass; repeated successfully 20 consecutive times
• Node 20 test run — 4/4 pass
• zero-boundary mutation (<= 0 to < 0) — fails the invalid-amount regression as expected
• npx tsc --noEmit — pass
• npm run build — pass
• opennextjs-cloudflare build — pass; bundle generated locally, no deployment
• git diff --check — pass
• npm ci — pre-existing failure: the committed lockfile no longer satisfies the ranged versions in package.json
• npm run lint — pre-existing failure: next lint is no longer a supported Next.js command
• committed dependency graph — 12 existing audit findings; no dependency or lockfile changes in this PR

Checklist

• Focused change with a clear description
• Ran format / lint / tests (tests/typecheck/build pass; repository lint command is broken as noted above)
• Updated docs or CHANGELOG if relevant (not needed for this internal policy correction)
• Linked the related issue

[royalpinto007]

Thanks. This duplicates #4 and both conflict - please rebase and keep one implementation.

[vsolano9]

Rebased this PR onto current main and kept a single implementation here, per the request. The closed #4 implementation is not duplicated: this branch retains the existing main Vitest setup, adds the finite-and-positive refund guard to the shared escalated path, and folds invalid-value coverage into lib/policy.test.ts.

Validation on 061575892182a23ebd9b76fc253cdcabcff43d01: npm test (34/34), npx tsc --noEmit, npm run build, focused npx vitest run lib/policy.test.ts (10/10), and a direct 5-value invalid-refund probe all pass. npm run lint remains unavailable because this repository still invokes removed next lint (Invalid project directory .../lint).

[vsolano9]

Follow-up: added the exact-at-limit ($50) regression assertion to the existing policy test without adding another harness. Final pushed head is 3c916214b0655891fcb20d2d6b2dbd66addaa530; full npm test is 34/34 and focused policy tests are 10/10.