Fix JSON decoding with PocketBase rereadable bodies

[Phloraxx]

Hotfix

Production post-cutover verification found that valid authenticated JSON POST requests were rejected with 400 Invalid JSON body.

Root cause: PocketBase wraps request bodies in an auto-rereadable reader. decodeJSON used a second json.Decoder.Decode call to prove EOF; on a real network request, the PocketBase reader could rewind before that second decode, making the same JSON appear as a second value.

Fix:

• snapshot the request body once and strictly decode from an immutable byte reader
• retain unknown-field and single-JSON-value validation
• add a regression test using a real httptest.Server + HTTP client, not only direct mux requests

Local validation:

• uncached full Go test suite passed
• race detector passed
• go vet passed
• staticcheck passed
• govulncheck: no reachable vulnerabilities
• clean Docker build passed
• real container/network smoke test returned 201 for authenticated POST /api/payments

This is intentionally limited to two files.