fix(auth): validate salt payload strings

[aiirvizionz]

Summary

• reject missing, blank, or non-string salt payloads before user-record lookup/update
• trim valid salts before storing and returning them
• add focused POST regression coverage for invalid object payloads and trimmed valid salts

Validation

• git diff --check
• node node_modules\vitest\vitest.mjs run --config $env:TEMP\qryptchat-vitest-minimal.config.mjs "src/app/api/auth/salt/route.test.js" (5 tests)

Billing

• uGig billable PR candidate: expected invoice $0.50 if accepted/merged
• Not counted as revenue until paid/settled