fix(server): reject malformed UTF-8 Control API bodies

[xuedingjie]

Problem

The authenticated Control API decoded JSON request bodies with the default TextDecoder. Malformed UTF-8 was replaced with U+FFFD and then accepted by JSON.parse, so fields such as Variable values could be silently changed before validation and persistence.

Fix

Use a fatal UTF-8 decoder for Control API JSON bodies. Decoding failures continue to use the existing 400 invalid-request response. Add a regression test proving that malformed bytes neither succeed nor persist a Variable.

This aligns Control API input handling with the strict decoder already used by the Integration and Webhook callback paths and with RFC 8259 section 8.1.

Verification

• npx --yes bun@1.4.0 x vitest run --config vitest.config.ts test/control.test.ts
• npx --yes bun@1.4.0 x oxfmt --check apps/server/node/control.ts apps/server/test/control.test.ts
• npx --yes bun@1.4.0 x oxlint --deny-warnings apps/server/node/control.ts apps/server/test/control.test.ts
• npx --yes bun@1.4.0 x tsc --noEmit -p apps/server/tsconfig.json

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{On-demand reviews are free for the next 14 days. After that, they cost $0.25 per reviewed file.}

Or wait 16 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 0f5f8408-3d68-445b-84d2-47c5fbe43629

📥 Commits

Reviewing files that changed from the base of the PR and between 59bec4a and 408f7d1.

📒 Files selected for processing (3)

• apps/server/node/config.ts
• apps/server/node/control.ts
• apps/server/test/config.test.ts

---

_{Comment @coderabbitai help to get the list of available commands.}