fix(usage): coerce and validate topup amount_usd as a finite number

[AliaksandrNazaruk]

Problem

POST /api/usage/topup read amount_usd raw from JSON and validated it with only !amount_usd and amount_usd < 1 || amount_usd > 10000. A non-numeric value like "abc" is truthy (passes the presence check) and both "abc" < 1 and "abc" > 10000 are false (NaN comparisons), so it slipped through and was forwarded to createCoinpayPayment and inserted into credit_deposits as a garbage amount. A numeric string like "50" was likewise stored as a string. (See #39.)

Fix

Coerce with Number() and guard with Number.isFinite, matching the existing pattern in funding/create-invoice/route.ts (L33–36). Downstream now always receives a real number.

const amount_usd = Number(body.amount_usd);
if (!Number.isFinite(amount_usd) || amount_usd < 1 || amount_usd > 10000) {
  return NextResponse.json({ error: "Amount must be between $1 and $10,000" }, { status: 400 });
}

Tests

Added usage/topup/__tests__/route.test.ts (mirroring the existing auth route-test style): non-numeric "abc" → 400 (and CoinPay/insert not called), out-of-range → 400, valid number → 200 with a numeric amount passed to CoinPay and the deposit row, and a numeric string coerced to a number.

Fixes #39.