fix: Handle run-test-payment failures safely

[ValeraFinebits]

POST /plugins/payjoin/run-test-payment threw on a malformed body and let any
failure from the payjoin flow escape the action. BTCPay reacts to an exception
escaping plugin code by disabling the plugin and stopping the host, so a bad
request or a transient RPC error took the whole dev server down. The endpoint is
[CheatModeRoute], so this only hit cheat-mode servers, which is where the
manual test plan runs.

• A null body returns 400 instead of throwing ArgumentNullException.
• The flow moved to RunTestPaymentCoreAsync, wrapped in a catch that logs and
  reports. A genuine cancellation is still re-thrown.

[Copilot]

Pull request overview

Adds a safety boundary around cheat-mode test payments to prevent plugin or host shutdowns.

Changes:

• Returns 400 for null request bodies.
• Logs unexpected failures while preserving cancellation behavior.
• Updates null-body test coverage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
UIPayJoinController.cs	Adds validation and exception handling.
UIPayJoinControllerTests.cs	Verifies null bodies return 400.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chavic]

Requesting changes for the missing regression coverage.

The implementation passes locally. However, the committed tests do not cover the exception boundary this PR adds. Please add cases that verify:

• An ordinary exception returns a structured failure response.
• Cancellation of the actual request propagates.
• An OperationCanceledException without a cancelled request token returns a failure response.

I tested these cases locally. All 273 tests passed with the current implementation. I then deliberately broke each behavior in an isolated copy. The 270 existing unit tests still passed; the added cases detected each regression.

Please assert the failure response without requiring raw exception text. That leaves room to return a generic client message while logging the details.

[ValeraFinebits]

Requesting changes for the missing regression coverage.

The implementation passes locally. However, the committed tests do not cover the exception boundary this PR adds. Please add cases that verify:

• An ordinary exception returns a structured failure response.
• Cancellation of the actual request propagates.
• An OperationCanceledException without a cancelled request token returns a failure response.

I tested these cases locally. All 273 tests passed with the current implementation. I then deliberately broke each behavior in an isolated copy. The 270 existing unit tests still passed; the added cases detected each regression.

Please assert the failure response without requiring raw exception text. That leaves room to return a generic client message while logging the details.

@chavic Done.