fix(waitlist): reject invalid JSON requests

[SabFabDev]

Summary

• return a client-facing 400 for malformed JSON instead of falling through to the generic 500 handler
• reject valid JSON values that are not request objects
• cover malformed and non-object request bodies with regression tests

This is the bounded ThreatCrush bugfix delivered under the accepted uGig scope (application 4e650370-bc54-46e1-986b-25a0053fc310).

Verification

• pnpm --filter @profullstack/threatcrush-web exec vitest run src/app/api/waitlist/__tests__/route.test.ts — 1 file passed, 11 tests passed
• pnpm --filter @profullstack/threatcrush-web build — passed (compiled, TypeScript checked, 61 static pages generated)
• pnpm --filter @profullstack/threatcrush-web test — 33 files passed / 2 failed; 231 tests passed / 1 failed (plus one failed suite with 0 tests). The failures are unrelated existing usage/topup test issues: a stale expected error message and a hoisted mock initialization error.

Scope

Minimal API error-handling change plus focused regression tests; no schema or UI changes.