fix(api): reject invalid install skill ids

[dirtybits]

Summary

• validate non-chain install route IDs as UUIDs before database initialization or SQL UUID casting
• return the existing 404 {"error":"Skill not found"} contract for malformed repo-skill IDs
• update install fixtures to use valid UUIDs and add a regression proving malformed IDs perform no database work

Test plan

• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism __tests__/api/skills-install.test.ts
• npm run format:check
• npm run lint --workspace @agentvouch/web
• npm run typecheck --workspace @agentvouch/web
• npm test --workspace @agentvouch/web -- --maxWorkers=1 --no-fileParallelism
• npm exec --workspace @agentvouch/web -- next build --webpack
• git diff --check origin/main...HEAD

Not verified

• No browser or live database smoke was run; this is a route-boundary validation change covered by unit tests.

[qodo-code-review]

ⓘ Qodo reviews are paused because your trial has ended. Ask your workspace admin to add credits to resume reviews. Manage billing