fix(api): validate public agent route pubkeys

[dirtybits]

Summary

• reject malformed Solana wallet path parameters in public agent identity and trust GET routes before downstream work
• reuse the configured Solana context and shared isValidChainAddress boundary helper
• add no-side-effect regressions and replace invalid success fixtures with a valid Solana public key
• record the focused implementation and verification in .agents/plans/validate-agent-public-route-pubkeys.plan.md

Test plan

• npm test --workspace @agentvouch/web -- __tests__/api/agent-identity-route.test.ts __tests__/api/agent-trust-route.test.ts --maxWorkers=1 --no-fileParallelism (17 tests)
• npm run format:check
• npm run lint:web
• npm run typecheck
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism (128 files / 929 tests)
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check

Notes

No live Solana RPC, database, browser, wallet, or deployment flow was run. The webpack build passed with the repository's existing ox dynamic-dependency warning and expected static-generation DATABASE_URL fallback logs because local database credentials are absent.