feat(api): BA-116 reject malformed JSON with safe client 400 error response

[ranjeetprabhatedu-dotcom]

Summary

This PR implements BA-116 to reject malformed JSON request bodies with a safe, standardized HTTP 400 client error rather than allowing an unhandled 500 server error.

• Implements malformedJsonHandler middleware in app.controller.ts and registers it in main.ts to intercept SyntaxError with status 400 from body parsing.
• Returns a clean JSON error response ({ statusCode: 400, message: 'Malformed JSON payload in request body', error: 'Bad Request' }).
• Passes non-syntax errors cleanly to next(err) to preserve downstream error handling.
• Adds comprehensive unit tests in app.controller.spec.ts covering both malformed JSON interception and regular error passthrough.
• Scoped strictly to the 3 allowlisted files:
  • BackendAcademy/src/main.ts
  • BackendAcademy/src/app.controller.ts
  • BackendAcademy/src/app.controller.spec.ts

Closes #1029