test: cover handler query validation

[JetMatrix]

/claim #71

Summary

• Return 400 validation responses for malformed transaction SQL and params instead of falling through to the generic 500 error path.
• Expand src/handler.test.ts coverage for non-JSON query requests, invalid query params, raw transaction forwarding with params, invalid transaction SQL, and invalid transaction params.
• Keep this focused on handler query validation, separate from the handler route-gate coverage in test: cover StarbaseDB handler route gates #189.

Verification

• .\node_modules\.bin\vitest.cmd run src/handler.test.ts -> 13 tests passed
• .\node_modules\.bin\vitest.cmd run src/handler.test.ts --coverage.enabled true --coverage.include src/handler.ts --coverage.reporter text --coverage.thresholds.lines=0 --coverage.thresholds.branches=0 --coverage.thresholds.functions=0 --coverage.thresholds.statements=0 -> passed; src/handler.ts reports 59.63% statements / 63.33% branches / 29.62% functions / 61.32% lines in the focused run
• .\node_modules\.bin\prettier.cmd --check src/handler.ts src/handler.test.ts -> passed
• git diff --check -- src/handler.ts src/handler.test.ts -> passed with Windows CRLF warnings only
• .\node_modules\.bin\vitest.cmd run -> new handler tests pass; current main still has 4 unrelated baseline failures in src/rls/index.test.ts

Notes

• No UI demo video is included because this is backend/unit-test-only validation coverage; the verification commands above demonstrate the behavior.
• Transparency: AI-assisted with Codex; I reviewed the diff and verified locally before submitting.