fix: validate checkout token amounts

[worlldz]

Summary

• validate checkout amounts as positive plain decimals within the selected token's precision
• return a 400 response for unsupported formats instead of letting parseUnits throw or round the value
• add focused Node test coverage and run it in CI

Why

POST /api/checkout/intent first coerced the amount with Number() and then passed the original string to parseUnits(). Values such as 1e3 passed the numeric check but caused parseUnits() to throw, producing an unhandled server error. Values beyond the token's six-decimal precision could also be rounded instead of rejected.

The new parser accepts only positive plain-decimal values that can be represented exactly by the token.

Testing

• npm test
• npx tsc --noEmit
• npm run lint
• npm run build