fix(api): validate Base x402 skill IDs - #167

Summary

• reject malformed nonempty skillDbId, skill_id, and skillId values in Base x402 verify and settle requests before route selection, database lookup, payment verification, or settlement work
• preserve the distinction between a missing ID and an invalid supplied ID so malformed Base fields cannot fall through to legacy proof handling
• add no-side-effect regressions for both x402 routes and record the focused work in .agents/plans/validate-x402-skill-db-id.plan.md

Test plan

• npm test --workspace @agentvouch/web -- __tests__/api/x402-routes.test.ts --maxWorkers=1 --no-fileParallelism (6 tests)
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism (128 files / 929 tests)
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

Notes

No live database, payment, wallet, or deployment flow was run. The production build passed with the repository's existing ox/viem dynamic-import warning and expected static-generation DATABASE_URL fallback logs because local database credentials are absent.