test: cover JSON import payload validation

[duct-tape2]

Summary

• Add focused Vitest coverage for malformed JSON import payload shapes.
• Cover application/json requests where data is missing, null, or an object instead of an array.
• Assert the existing 400 validation response is returned and executeOperation is not called.

Bounty / Claim

/claim #71

This is a small test-only coverage slice for #71, separate from the active JSON import multipart upload / column mapping PR.

Verification

• ./node_modules/.bin/vitest run src/import/json.test.ts -> 7 tests passed
• ./node_modules/.bin/prettier --check src/import/json.test.ts -> passed
• git diff --check -> passed
• Hidden non-ASCII and CRLF checks on src/import/json.test.ts -> no matches

Notes

• No production behavior changes.
• No paid API required.
• No secrets required.
• Local verification included.

[duct-tape2]

Hi, ping on this test coverage PR. Tests cover the JSON validation paths I noticed lacking - happy to expand to additional payload shapes or split into smaller focused PRs if that's easier to review.