fix: validate agent request messages

[LobsterQBA]

What changed

• reject empty and oversized messages before they reach the agent loop
• reject non-string message payloads instead of coercing them
• add HTTP-level coverage for all invalid request cases

Why

The local API already limits body size, but an empty or malformed message could still create a meaningless agent turn. Validating the field keeps live-model calls and persisted traces useful.

Validation

• uv run pytest -q (14 passed)
• uv run ruff check .
• git diff --check