[FIX] Surface inbound decode failures (decode_app_message error routing)

[TexasCoding]

Problem

kalshi.fix.messages.decode_app_message(raw) returns None for two distinct cases:

1. No registered model for the message type (admin / not-yet-implemented flow).
2. A registered model whose payload failed schema validation (a malformed field).

Callers can't distinguish them. When the FIX flow is wired into a production consumer via FixSession(on_message=...), a genuine ExecutionReport that arrives with a single off-spec field (e.g. a DollarDecimal/FixedPointCount in an unexpected format) would be decoded to None and likely ignored — silently losing a fill. A logger.warning fires, but that only helps if logs are watched.

(Surfaced by the PR #431 automated review.)

Options

1. A FixDecodeError sentinel/exception — swallowed internally on the session dispatch path, surfaced to direct callers of decode_app_message.
2. Return a (FixMessage | None, Exception | None) tuple.
3. An on_decode_error hook on FixSession so consumers can route decode failures (dead-letter, halt, alert) without changing the FixMessage | None return type.

Option 3 fits the existing callback-based session ergonomics best and keeps the simple decode_app_message contract for casual callers.

Scope

Best landed with the typed inbound delivery / streaming ergonomics (the production-consumer wiring), not the message-layer PR #431. Part of #402; depends on #424.

Acceptance

A malformed inbound application message is observable by the consumer (not silently dropped), with a test that drives a malformed ExecutionReport through FixSession and asserts the error is surfaced via the chosen mechanism.