test: reject non-string echo messages

- Verify POST /echo returns HTTP 400 for non-string message values
- Assert invalid request bodies receive the expected generic error response

src/server.test.ts

@@ -95,6 +95,23 @@ describe("API endpoints", () => {
     });
   });
 
+  it("POST /echo rejects a non-string message", async () => {
+    const message = "a".repeat(501);
+
+    const response = await app.inject({
+      method: "POST",
+      url: "/echo",
+      payload: {
+        message: 123,
+      },
+    });
+
+    assert.equal(response.statusCode, 400);
+    assert.deepEqual(response.json(), {
+      error: "Invalid request body",
+    });
+  });
+
   it("returns 404 for an unknown endpoint", async () => {
     const response = await app.inject({
       method: "GET",