Refuse an empty vault-import body as a 400, and cover a non-backup body

Without the explicit length check, parseBackupWrapper's JSON failure on an
empty body escapes as an internal error — the server reporting a fault for a
request the caller simply sent empty. Also pins that a body which is not a
backup at all answers 4xx rather than 5xx, since the two failures take
different paths and only one of them was exercised.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01Vtx94nXDmNgXEeThUZP4QN

js/packages/cli/test/api.test.ts

@@ -1041,6 +1041,25 @@ describe("vault export and import", () => {
     });
     expect(refused.status).toBe(409);
     expect(refused.json.detail).toContain("belongs to profile");
+
+    // An empty body is a caller mistake, not a server fault. Without the
+    // explicit check, parseBackupWrapper's JSON error escapes as 500.
+    const empty = await call("POST", "/api/v1/vault/import", {
+      password: PASSWORD,
+      raw: "",
+      headers: { "content-type": "application/json" },
+    });
+    expect(empty.status).toBe(400);
+    expect(empty.json.detail).toContain("backup body is required");
+
+    // As is a body that is not a backup at all.
+    const garbage = await call("POST", "/api/v1/vault/import", {
+      password: PASSWORD,
+      raw: "{not a backup}",
+      headers: { "content-type": "application/json" },
+    });
+    expect(garbage.status).toBeGreaterThanOrEqual(400);
+    expect(garbage.status).toBeLessThan(500);
   });
 });