fix: add amount validation for zap and bet endpoints

Validate amountSats is a positive integer (1–1,000,000) on both
/zap and /bets/place endpoints to prevent negative, zero, or
absurdly large amounts.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/bets.ts

@@ -55,6 +55,10 @@ betsRouter.post('/place', rateLimit(60_000, 10), async (c) => {
     return c.json({ error: 'Missing required fields.' }, 400)
   }
 
+  if (typeof amountSats !== 'number' || !Number.isInteger(amountSats) || amountSats < 1 || amountSats > 1_000_000) {
+    return c.json({ error: 'amountSats must be an integer between 1 and 1,000,000' }, 400)
+  }
+
   // Verify fight is still open
   const fight = await db.select().from(schema.fights)
     .where(eq(schema.fights.id, fightId)).limit(1)

server/src/routes/payments.ts

@@ -281,7 +281,10 @@ paymentsRouter.post('/zap', rateLimit(60_000, 10), async (c) => {
   }>()
 
   if (!winnerId || !fightId) return c.json({ error: 'Missing winnerId or fightId' }, 400)
-  const amount = amountSats || 21
+  if (typeof amountSats !== 'number' || !Number.isInteger(amountSats) || amountSats < 1 || amountSats > 1_000_000) {
+    return c.json({ error: 'amountSats must be an integer between 1 and 1,000,000' }, 400)
+  }
+  const amount = amountSats
 
   // Verify the fight exists and this bot actually won
   const fightRows = await db.select({