fix(http): 400 on malformed JSON body instead of 500

express.json() raising a parse error was falling through to the generic
500 handler, which reads as a server fault for what is a bad request.
Also maps the body-size limit to 413.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

server/index.js

@@ -81,6 +81,9 @@ app.use((req, res) => {
 
 // eslint-disable-next-line no-unused-vars -- Express identifies error handlers by arity
 app.use((err, req, res, _next) => {
+  // A body express.json() could not parse is the caller's fault, not ours.
+  if (err.type === 'entity.parse.failed') return res.status(400).json({ error: 'malformed JSON body' });
+  if (err.type === 'entity.too.large') return res.status(413).json({ error: 'request body too large' });
   console.error('[http]', err);
   res.status(500).json({ error: 'internal error' });
 });