Fix WebChat JSON request parsing

[shzxm]

Summary

• parse heterogeneous WebChat JSON request objects explicitly with Gson
• require a JSON object at the top level and reject malformed, array, or null bodies
• apply the same parser to every WebChat write route and session bootstrap
• add regression coverage for nested objects, arrays, booleans, numbers, and invalid top-level bodies

Root cause

Ktor ContentNegotiation could not deserialize request bodies directly into Map<String, Any?> with the configured Gson converter. Every affected POST, PATCH, and PUT endpoint failed before route logic with Failed to convert request body to class kotlin.collections.Map.

Impact

This fixes conversation creation and runs used by external WebChat clients and Telegram bridges, plus conversation updates, task clarification, workspace writes/moves, browser actions, and body-token session bootstrap.

Validation

• upstream CI passed
• 542 Android unit tests passed
• Flutter test and analyze passed
• develop standard debug APK assembled successfully
• Android lint passed
• final APK built from commit 0107bff3f and installed successfully on a physical Android device

[XuYouo]

Request changes: the WebChat login handshake is still broken.

1. [P1] /webchat/api/session/bootstrap still returns HTTP 500 on success. The new request parser lets the route reach the success branch, but handleWebChatSessionBootstrap still uses call.respond(...) for a heterogeneous Boolean + nested Map payload. Since ContentNegotiation registers json(McpJson) before gson(), the first converter throws Serializing collections of different element types is not yet supported; Ktor does not fall back to Gson. App.tsx waits for this request before loading /bootstrap, so WebChat login still fails. Please serialize this response through the same explicit Gson/respondText path and add a route-level regression test that asserts a 2xx response and valid JSON.

2. [P2] Session bootstrap swallows invalid JSON bodies. runCatching { call.receiveWebChatJsonObject() }.getOrDefault(emptyMap()) catches the BadRequestException produced for malformed, array, or null bodies. With a valid Authorization header, the route continues and creates a session instead of returning 400, contrary to the PR contract. Preserve parser failures; if header-only bootstrap must remain supported, distinguish a genuinely absent body from an invalid JSON body.

Validation on head 0107bff3f: git diff --check passed; the added parser test passed on the exact head and after a clean merge with current main; a minimal route-level probe using the production converter order reproduced HTTP 500 for the success payload.