fix(api): separate query params from body payload in REST tool POST requests

[Tissandier]

📝 Summary

This PR changes the way the tools that are created with a REST api are using the tool payload. Before the change it was not possible to have a tool doing a POST on a REST API with query parameters

---

🏷️ Type of Change

• Bug fix
• Feature / Enhancement
• Documentation
• Refactor
• Chore (deps, CI, tooling)
• Other (describe below)

---

🧪 Verification

Check	Command	Status
Lint suite	make lint	OK
Unit tests	make test	OK
Coverage ≥ 80%	make coverage	yes

---

✅ Checklist

• Code formatted (make black isort pre-commit)
• Tests added/updated for changes
• Documentation updated (if applicable)
• No secrets or credentials committed

---

📓 Notes (optional)

Screenshots, design decisions, or additional context.

[crivetimihai]

Thanks @Tissandier. Good fix — correctly separates query parameters from the JSON body for POST/PUT/PATCH/DELETE REST tool invocations. The test case covering path params, templated query params, static query params, and body params is thorough. LGTM.

[marekdano]

Thanks for the contribution, @Tissandier!!!

Summary

This PR successfully fixes a bug where REST API tools couldn't properly handle POST requests with query parameters. The fix correctly separates query parameters from the JSON body payload.

---

✅ Test Coverage

New Test: test_invoke_tool_rest_post_with_path_query_and_body_params

✅ test_invoke_tool_rest_parameter_substitution - PASSED
✅ test_invoke_tool_rest_post_with_path_query_and_body_params - PASSED  
✅ Database performance tests - 57 passed

---

🎯 What This Fixes

Before (Broken):

# POST with query params failed - all params went to body
POST /api/users/456/posts
Body: {"user_id": 456, "api_key": "secret123", "title": "New Post", "content": "Hello"}
# Query params were lost or incorrectly placed

After (Fixed):

# POST with query params works correctly
POST /api/users/456/posts?api_key=secret123&version=v2
Body: {"title": "New Post", "content": "Hello"}
# Path params substituted, query params in URL, body params in JSON

---

🔒 Security & Performance

• ✅ No security concerns introduced
• ✅ No performance regressions
• ✅ Proper parameter sanitization maintained
• ✅ HTTP client timeout handling unchanged

---

💡 Optional Future Enhancements (Non-blocking)

The following could be addressed in follow-up work if desired:

1. Add test for GET requests with static query params (e.g., ?version=v2)
2. Add tests for PUT/PATCH methods with query params (only POST is tested)

LGTM 🚀