fix(sponsor): reject non-numeric amount types

[aiirvizionz]

Summary

• reject sponsor amount payloads that are not strings or numbers before numeric coercion
• keep existing decimal string validation and finite/minimum checks
• add regression coverage for array, object, and boolean values

Why

The prior decimal-string guard prevents inputs like 1e2 and 0x10, but non-string payloads could still pass through JavaScript numeric coercion. For example, [5] can become 5 via Number([5]). Sponsor checkout should only accept explicit string/number amount values.

Validation

• vitest run apps/web/lib/sponsor-amount.test.ts (5 tests passed)