fix(api): validate sponsored micro-USDC inputs

[dirtybits]

Summary

• reject non-finite, fractional, and unsafe JSON number values for sponsored purchase expectedPriceUsdcMicros and maxSetupFeeUsdcMicros before they can reach BigInt
• return a stable 400 at the purchase-prepare boundary without invoking sponsored transaction preparation
• preserve exact large micro-USDC inputs through the canonical decimal-string representation
• add helper and route regressions, plus the focused implementation record in .agents/plans/validate-sponsored-micros-inputs.plan.md

Test plan

• npm test --workspace @agentvouch/web -- __tests__/api/sponsored-transaction-routes.test.ts __tests__/lib/sponsoredPurchase.test.ts --maxWorkers=1 --no-fileParallelism (2 files / 27 tests)
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism (128 files / 930 tests)
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

Notes

No live sponsored transaction, database, wallet, or deployment flow was run. The webpack build passed with the repository's existing ox/viem dynamic-import warning and expected static-generation DATABASE_URL fallback logs because local database credentials are absent.