Chat payload hardening: use JSON body for multi-policy queries, avoid sensitive query params

[ApexYash11]

Summary

Harden chat request format to avoid sensitive data exposure and improve API consistency.

Why

Architecture notes call out privacy/security boundaries and recommend JSON payloads for multi-policy chat questions.

Scope

• Ensure multi-policy chat uses POST JSON body for question payloads.
• Remove/avoid sensitive values in URL query strings for chat requests.
• Validate backend request schema and frontend request builders are aligned.

Acceptance Criteria

• Multi-policy chat payload is sent via JSON body only.
• No sensitive chat inputs appear in URL query params.
• Endpoint contract tests cover request format and validation errors.

Source

• docs/SITE_FLOW_AND_IMPROVEMENTS.md (Improvement Plan fixes #2, Success Criteria)