refactor(api): 请求体解析收成 readJson / parseBody

54 处 handler 都手写同一段：
  const parsed = X.safeParse(await c.req.json().catch(() => null))
  if (!parsed.success) return failure(c, 400, "invalid-request", ...)
漏写 .catch 就是一个畸形请求打出 500。

- http.ts 加 readJson（读 + 校验）和 parseBody（再加上 400）。parseBody 不给
  message 时回 zod 的第一条 issue —— 后台表单原来就是这么写的，fallback 文案
  「Invalid payload」/「参数错误」只在 issues 为空时才用得上，实际走不到
- 51 处换成 parseBody；另 3 处失败时带别的错误码或和路径参数一起判，换成 readJson
- 错误码、状态码、文案、判断顺序都不变

实跑核过：非 JSON 请求体回原来的固定文案，公告标题为空回 zod issue。

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/routes/admin/account.ts

@@ -33,7 +33,7 @@ import { isUserOnline, onlineUserIds } from "../../auth/presence"
 import { revokeUserSessions } from "../../auth/session"
 import { requireSuperAdmin, type AppEnv } from "../../auth/middleware"
 import { db, schema } from "../../db"
-import { failure, success } from "../../http"
+import { failure, parseBody, success } from "../../http"
 import { queryInteger, sampleUser } from "../helpers"
 
 export const adminAccountRoutes = new Hono<AppEnv>()
@@ -252,17 +252,8 @@ adminAccountRoutes.get("/users/:id", requireSuperAdmin, async (c) => {
 
 adminAccountRoutes.put("/users/:id", requireSuperAdmin, async (c) => {
   const id = queryInteger(c.req.param("id"), 0, { min: 1 })
-  const parsed = updateUserRequestSchema.safeParse(
-    await c.req.json().catch(() => null),
-  )
-  if (!parsed.success) {
-    return failure(
-      c,
-      400,
-      "invalid-request",
-      parsed.error.issues[0]?.message ?? "Invalid payload",
-    )
-  }
+  const parsed = await parseBody(c, updateUserRequestSchema)
+  if (!parsed.success) return parsed.response
   const data = parsed.data
   const [existing] = await selectUser(id)
   if (!existing) return failure(c, 404, "user-not-found", "User does not exist")
@@ -350,17 +341,8 @@ adminAccountRoutes.put("/users/:id", requireSuperAdmin, async (c) => {
 })
 
 adminAccountRoutes.post("/users", requireSuperAdmin, async (c) => {
-  const parsed = importUsersRequestSchema.safeParse(
-    await c.req.json().catch(() => null),
-  )
-  if (!parsed.success) {
-    return failure(
-      c,
-      400,
-      "invalid-request",
-      parsed.error.issues[0]?.message ?? "Invalid payload",
-    )
-  }
+  const parsed = await parseBody(c, importUsersRequestSchema)
+  if (!parsed.success) return parsed.response
   const rows = parsed.data.users
   type Prepared = {
     username: string
@@ -544,11 +526,8 @@ function isForeignKeyViolation(error: unknown) {
 class UserHasSubmissionsError extends Error {}
 
 adminAccountRoutes.delete("/users", requireSuperAdmin, async (c) => {
-  const parsed = deleteUsersRequestSchema.safeParse(
-    await c.req.json().catch(() => null),
-  )
-  if (!parsed.success)
-    return failure(c, 400, "invalid-request", "ids is required")
+  const parsed = await parseBody(c, deleteUsersRequestSchema, "ids is required")
+  if (!parsed.success) return parsed.response
   const me = c.get("user")!.id
   if (parsed.data.ids.includes(me)) {
     return failure(