Reject unknown v2 API parameters

[caydyan]

Fixes #2164.

This is a develop-based replacement for #3367.

Summary:

• Reject unrecognized v2 API query parameters before route arguments are coerced.
• Reuse the parsed request query parameters while preparing route args.
• Keep allowed parameters such as verbose working.
• Add regression coverage for both unknown-parameter rejection and the allowed verbose path.

Tests:

• .venv/bin/python -m pytest counterpartycore/test/units/api/apiserver_test.py -q
• .venv/bin/python -m ruff check counterpartycore/lib/api/apiserver.py counterpartycore/test/units/api/apiserver_test.py
• .venv/bin/python -m ruff format --check counterpartycore/lib/api/apiserver.py counterpartycore/test/units/api/apiserver_test.py
• git diff --check

BTC payout address if this qualifies for a contributor/security reward: bc1qev5ant33v5y89qqjvcf4mh9hlax5svqf5xd7gc