Reject invalid refund amounts before automatic action

[vsolano9]

What & why

The refund guardrail currently auto-resolves zero and negative values, and treats non-finite values as ordinary over-limit refunds. This validates the amount before any automatic action so malformed triage output is routed to a human with a clear reason.

Closes #3

Changes

• require refund amounts to be finite and greater than zero before auto-resolution
• escalate invalid values without claiming they merely exceed the configured limit
• add focused policy coverage for valid below/at/above-limit, zero, negative, non-finite, and missing amounts
• expose the test suite through npm test without adding dependencies

Validation

• npm test — 4/4 pass; repeated successfully 20 consecutive times
• Node 20 test run — 4/4 pass
• zero-boundary mutation (<= 0 to < 0) — fails the invalid-amount regression as expected
• npx tsc --noEmit — pass
• npm run build — pass
• opennextjs-cloudflare build — pass; bundle generated locally, no deployment
• git diff --check — pass
• npm ci — pre-existing failure: the committed lockfile no longer satisfies the ranged versions in package.json
• npm run lint — pre-existing failure: next lint is no longer a supported Next.js command
• committed dependency graph — 12 existing audit findings; no dependency or lockfile changes in this PR

Checklist

• Focused change with a clear description
• Ran format / lint / tests (tests/typecheck/build pass; repository lint command is broken as noted above)
• Updated docs or CHANGELOG if relevant (not needed for this internal policy correction)
• Linked the related issue