Refuse a PRIVMSG or NOTICE whose body or meta has the wrong type (closes #245)

Over the HTTP API, a PRIVMSG or NOTICE body was checked only by
decoding it into a list of strings. JSON null decodes into an empty
string there, and meta was not checked at all, so a null line, or a
meta that is not an object, reached every recipient.

handlePrivmsg now answers 400 invalid request body, before anything
else, when body is present and is not an array of strings, or meta is
present and is not an object. The check returns the lines it accepted,
and the empty-body check counts those, so body is decoded once. A
missing or empty body still gets ERR_NOTEXTTOSEND. README.md says so.

Model: opus-5-5

internal/handlers/api.go

@@ -994,7 +994,7 @@ func (hdlr *Handlers) dispatchCommand(
 		hdlr.handlePrivmsg(
 			writer, request,
 			sessionID, clientID, nick,
-			command, target, body, meta, bodyLines,
+			command, target, body, meta,
 		)
 	case irc.CmdJoin:
 		hdlr.handleJoin(
@@ -1139,8 +1139,18 @@ func (hdlr *Handlers) handlePrivmsg(
 	nick, command, target string,
 	body json.RawMessage,
 	meta json.RawMessage,
-	bodyLines func() []string,
 ) {
+	lines, ok := checkBodyAndMeta(body, meta)
+	if !ok {
+		hdlr.respondError(
+			writer, request,
+			"invalid request body",
+			http.StatusBadRequest,
+		)
+
+		return
+	}
+
 	if target == "" {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
@@ -1155,7 +1165,6 @@ func (hdlr *Handlers) handlePrivmsg(
 		return
 	}
 
-	lines := bodyLines()
 	if len(lines) == 0 {
 		hdlr.enqueueNumeric(
 			request.Context(), clientID,
@@ -1189,6 +1198,44 @@ func (hdlr *Handlers) handlePrivmsg(
 	)
 }
 
+// checkBodyAndMeta returns the lines in body. It returns false
+// when body is present and is not an array of strings, or meta
+// is present and is not an object. Each line is decoded as any
+// because decoding into []string turns a null line into "". A
+// null body or meta decodes without an error into nil.
+func checkBodyAndMeta(body, meta json.RawMessage) ([]string, bool) {
+	var lines []string
+
+	if body != nil {
+		var values []any
+
+		err := json.Unmarshal(body, &values)
+		if err != nil || values == nil {
+			return nil, false
+		}
+
+		for _, value := range values {
+			line, isString := value.(string)
+			if !isString {
+				return nil, false
+			}
+
+			lines = append(lines, line)
+		}
+	}
+
+	if meta != nil {
+		var fields map[string]any
+
+		err := json.Unmarshal(meta, &fields)
+		if err != nil || fields == nil {
+			return nil, false
+		}
+	}
+
+	return lines, true
+}
+
 // respondIRCError enqueues a numeric error reply, notifies
 // the broker, and sends HTTP 200 with {"status":"error"}.
 func (hdlr *Handlers) respondIRCError(