fix(api): validate side-effect tool input types

[cursor]

Bug and impact

Authenticated callers could crash the API process by sending malformed JSON to side-effect tools. A concrete repro was POST /v1/tools/webhook-send with method: null: after credit deduction, the handler called method.toUpperCase() outside its try/catch, closing the socket and taking down the Node process. The sibling email side-effect routes had the same class of unchecked string dereferences on to/subject.

Root cause

webhook-send, email-send, and send-email trusted TypeScript casts for untrusted request-body fields. Non-string JSON values passed the truthiness checks and then hit string methods directly.

Fix

• Added explicit non-empty string narrowing before using webhook URL, email recipient, subject, body/html, and custom from fields.
• Reject non-string webhook method values with 400 invalid_request before .toUpperCase().
• Kept the existing fallback behavior for unsupported string methods.
• Added focused critical-regression coverage for the field-type guards.

Validation

• npm run build with local test env: passed.
• node tests/critical-regressions.test.mjs: 6 passed, 0 failed.
• Runtime repro before fix: malformed webhook-send produced UND_ERR_SOCKET, then /health returned ECONNREFUSED.
• Runtime repro after fix: malformed webhook-send returned 400 invalid_request (method must be a string), then /health returned 200 { ok: true }.
• Sibling malformed email-send and send-email requests returned 400 invalid_request; /health remained 200.
• node --loader ts-node/esm tests/ssrf.test.js: passed.