fix(history): return 400 for null JSON payload

[Zhou-Weixin]

Description

POST /api/history assumes that the parsed JSON request body is an object. However, null is valid JSON and is parsed as None, causing an AttributeError when the route calls .get().

This change validates the request body before accessing its fields and returns the existing structured 400 INVALID_REQUEST response for non-object JSON payloads.

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Related Issues

N/A

Changes Made

• Validate that the parsed /api/history request body is a JSON object
• Return a structured 400 INVALID_REQUEST response for null and other non-object payloads
• Add an endpoint-level regression test for an application/json body containing null

Screenshots (if applicable)

N/A — backend-only API validation change.

Testing

• I have tested this change locally
• Existing tests pass (uv run pytest -q — 27 passed)
• Frontend builds successfully (pnpm build) — not run; frontend code is unchanged

Additional verification:

• Targeted regression test passes
• Verified through a real local HTTP server using curl
• Confirmed response: HTTP/1.1 400 BAD REQUEST
• Confirmed error code: INVALID_REQUEST
• python -m py_compile backend/routes/history_routes.py passes
• git diff --check passes