Strengthen route and MCP validation tests (codex) - #2365

## Objective
Improve backend API reliability by enforcing route status mapping, MCP validation, approval envelopes, and path traversal rejection behavior.

## Scope
- `src/server/request-parsers.ts`
- `src/server/route-utils.ts`
- `src/server/http-errors.ts`
- `src/server/terminal-routes.ts`
- `src/server/file-browser-routes.ts`
- `src/server/local-directory-routes.ts`
- `tests/backend/server/request-parsers.test.ts`
- `tests/backend/server/route-utils.test.ts`
- `tests/backend/server/dashboard-routes-error.test.ts`
- `tests/backend/server/terminal-routes.test.ts`
- `tests/backend/server/file-browser-routes.test.ts`
- `tests/backend/server/local-directory-routes.test.ts`
- `tests/backend/mcp/management-payload-parsers.test.ts`
- `tests/backend/mcp/mcp-management.test.ts`
- `docs/operations/runbook.md`
- Current verification gap: many validation tests exist, but the audit calls for route validation, status mapping, approval tests, and path traversal coverage to be explicit and consistent.
- Desired guarantee: malformed inputs map to 400/403/404 responses, 500s are sanitized, destructive MCP actions require non-reused approval, and path traversal never reaches filesystem/provider boundaries.

## Implementation Requirements
1. Add focused parser tests for empty strings, nullable fields, invalid enums, integer bounds, and boolean coercion in `tests/backend/server/request-parsers.test.ts`.
2. Extend route utility/error tests to assert validation errors produce client statuses while unexpected errors produce sanitized `Internal Server Error` responses and still call `next(error)`.
3. Add or extend path traversal tests for terminal, file browser, and local directory routes so `..`, encoded separators, absolute paths, and provider config IDs with separators are rejected before filesystem access.
4. Extend MCP payload and management tests to prove destructive actions require approval, mismatched or reused approval payloads fail, and parser errors are consistently shaped.
5. Update `docs/operations/runbook.md` with the validation/security behavior operators should expect when hostile paths or malformed management calls are rejected.

## Constraints
- Preserve existing public route contracts and error shapes unless tests reveal an actual inconsistency.
- Do not expose raw error messages for 500-level failures.
- Do not weaken MCP approval requirements for destructive actions.
- Mock filesystem, Docker, provider, and repository boundaries where route tests do not need real IO.

## Verification
- `pnpm run test:backend -- tests/backend/server/request-parsers.test.ts tests/backend/server/route-utils.test.ts tests/backend/server/dashboard-routes-error.test.ts tests/backend/server/terminal-routes.test.ts tests/backend/server/file-browser-routes.test.ts tests/backend/server/local-directory-routes.test.ts tests/backend/mcp/management-payload-parsers.test.ts tests/backend/mcp/mcp-management.test.ts`
- `pnpm run test:backend`
- `pnpm run lint`
- Success means invalid requests fail with intended statuses, 500s stay sanitized, approvals cannot be bypassed, and traversal attempts do not touch external state.