fix: reject malformed payment amount strings

[realmehmetali]

Summary

• replace partial parseFloat validation with strict decimal-string validation
• reject trailing junk, multiple decimal points, exponent notation, incomplete decimals, whitespace, and non-finite values
• preserve the existing negative, zero, and maximum-decimal error behavior
• add regression coverage for malformed payment inputs

Root cause

parseFloat accepts a valid numeric prefix and ignores trailing invalid characters. Values such as 1abc and 1.2.3 could therefore pass initial validation and fail later during transaction encoding.

Agent impact

At the AI-agent frontier, tool-generated payment inputs must fail closed. Strict decimal validation prevents malformed model output from reaching transaction encoding or producing ambiguous payment failures.

Fixes #313.

Validation

• focused validation suite: 22 tests passed
• account SDK typecheck
• account SDK build
• Biome formatting and lint checks on changed files

AI assistance

Codex assisted with implementation and regression-test preparation. I reviewed the public issue, surrounding validation behavior, test results, and final diff before submission.

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1