fix: validate Cashu token format before placing bets (BUG-S4)

Added getDecodedToken validation that rejects malformed tokens with
400 before any DB lookups. Tests cover empty, non-base64, truncated,
and random base64 tokens.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/bets.ts

@@ -1,5 +1,6 @@
 import { Hono } from 'hono'
 import { toError } from '../lib/utils.js'
+import { getDecodedToken } from '@cashu/cashu-ts'
 import { db, schema } from '../db/index.js'
 import { eq, desc } from 'drizzle-orm'
 import { calculateOdds } from '../engine/odds.js'
@@ -59,6 +60,13 @@ betsRouter.post('/place', rateLimit(60_000, 10), async (c) => {
     return c.json({ error: 'amountSats must be an integer between 1 and 1,000,000' }, 400)
   }
 
+  // Validate Cashu token format before any DB lookups
+  try {
+    getDecodedToken(cashuToken)
+  } catch {
+    return c.json({ error: 'Invalid Cashu token format.' }, 400)
+  }
+
   // Verify fight is still open
   const fight = await db.select().from(schema.fights)
     .where(eq(schema.fights.id, fightId)).limit(1)