backend: add malformed multipart upload test for STT endpoint

Goal

Make the STT multipart boundary reject missing, non-file, and empty audio uploads with a clear 422 response instead of silently sending audioBase64: null to the provider.

This is a request-validation task in a Japanese language-learning API. It is useful security hygiene, but the repository is not a cybersecurity toolkit.

Scope

• Work primarily in apps/api/tests/test_api_contract.py.
• Add focused TestClient cases for POST /v1/stt/transcribe using multipart/form-data.
• Cover a request with no file field, a text field named file, and an empty uploaded file.
• Assert each invalid request returns 422 with a stable, non-sensitive error detail and no traceback text.
• Make the smallest corresponding validation change in _stt_payload_from_request in apps/api/app/main.py.
• Preserve JSON mock mode: a JSON request that intentionally supplies mockText without audio must continue to work.
• Do not add generated audio, binary fixtures, local speech engines, API keys, or private data.
• Keep this as one focused PR and include Closes #49 in the PR body.

Acceptance Criteria

• Missing multipart file returns 422.
• A non-upload value under file returns 422.
• An empty uploaded file returns 422.
• Error details are clear and do not expose tracebacks or filesystem paths.
• Existing valid multipart upload and JSON mock-mode tests remain passing.

Suggested Verification

cd apps/api
.venv/bin/python -m pytest tests/test_api_contract.py -k "stt and multipart"
cd ../..
python3 scripts/check_public_tree.py

Codespaces is available if the backend environment is not installed locally: https://duct-tape2.github.io/ai-language-partner/community/CODESPACES_FIRST_PR.html