fix(auth): handle malformed send sms JSON

[aiirvizionz]

Summary

• return 400 for malformed send-sms JSON instead of falling through to the generic 500 handler
• stop invalid bodies before per-phone/global SMS cost controls and Supabase work
• add focused regression coverage for malformed JSON handling

Test

• node node_modules\vitest\vitest.mjs run --config %TEMP%\qryptchat-vitest-minimal.config.mjs "src/app/api/auth/send-sms/route.test.js"
• git diff --check

uGig billing

• Expected invoice: 0.50 USD if accepted/merged
• Counted as revenue now: no, pending review/payment