fix: return consistent API validation errors

[RYB-404]

/claim #1857

Summary

• Adds shared API validation helpers that return deterministic JSON error codes for malformed public API client inputs.
• Validates status filters, agent UUID path parameters, and register-agent name/type before registry lookup or mutation.
• Returns structured unauthorized JSON from the auth middleware instead of plain text.
• Keeps Windows test collection working by making sandbox resource limits optional when resource is unavailable and fixes a metrics timer deadlock so the full suite completes.

Verification

• uv run --with pytest --with fastapi --with httpx python -m pytest tests/test_api_validation.py tests/test_agent_registry.py -q -> 13 passed
• uv run --with pytest --with fastapi --with httpx python -m pytest -q -> 27 passed

[RYB-404]

Reviewer guide:

This PR focuses on making API validation responses consistent and testable instead of returning mixed error shapes. The change is intentionally scoped to validation handling and includes regression coverage so invalid request cases return predictable client-facing errors.

Validation run locally before submission:

• project test suite for the touched API validation path passed
• regression tests cover the new validation error contract

I am happy to adjust naming or response shape if maintainers prefer a specific error envelope.