fix(config): reject non-object raw yaml

[MicroMilo]

Summary

• make parseConfigYaml reject null, array, and primitive YAML roots
• align raw YAML validation with the save path root-type contract
• add focused coverage for non-object raw YAML inputs

Verification

• npm --workspace ui exec vitest run server/services/pilotdeckConfig.raw-yaml.test.js
• npm exec -- tsc --noEmit -p tsconfig.json

Notes

This is a real validate/save mismatch: /api/config/validate could normalize non-object YAML into defaults while the PUT path rejected the same input.

[MicroMilo]

Validation note:

This PR fixes a raw YAML validation/save contract mismatch.

[], null, and plain are valid YAML documents, but they are not valid PilotDeck config documents. The PilotDeck config root must be an object.

Before this change, parseConfigYaml used this flow:

normalizePilotDeckConfig(parseYaml(raw) || {})

That caused null to be normalized as {}, and allowed array/scalar YAML roots to enter the normalization path. As a result, /api/config/validate handled non-object YAML roots differently from the save path, which expects an object-shaped config document.

The regression test directly covers the invalid root shapes:

• array root: [];
• null root: null;
• scalar root: plain.
  Validation commands used by this PR:

npm --workspace ui exec vitest run server/services/pilotdeckConfig.raw-yaml.test.js
npm exec -- tsc --noEmit -p tsconfig.json

This PR correctly defines the document-level contract: syntactically valid YAML is accepted only when its root value is a config object.