fix(payout): reject malformed amounts and drop float conversion (#41)

[devorun]

Summary

Fixes #41.

The payout endpoint parsed user-supplied amounts with parseFloat, which accepts a valid numeric prefix and ignores the rest — so "1USDC" became 1 and "1.5abc" became 1.5, passing validation and moving a value the request body never wrote. The same parseFloat(...) * 1_000_000 + Math.floor conversion also silently truncated anything beyond six decimals.

Changes

• lib/circle/usdc-amount.ts (new): strict parseUsdcAmountToAtomicUnits / formatUsdcAtomicUnits helpers. This logic already existed privately in lib/circle/unified-balance-payout.ts; it is lifted into a shared module so there is a single implementation instead of two copies.
• app/api/payout/route.ts: replace the parseFloat-based convertToSmallestUnit and the parseFloat amount check with strict parsing. Malformed input ("1USDC", "1.5abc", "1e6", more than six decimals, empty/negative) now returns 400 Invalid amount instead of silently proceeding. Every amount passed downstream to the App Kit / Gateway SDK is derived from the validated atomic units, so no re-parsed float can drift from the validated value.
• lib/circle/unified-balance-payout.ts: consume the shared helpers (identical logic, behavior unchanged).

Tests

• New tests/usdc-amount.test.ts covers the reported cases ("1USDC", "1.5abc"), excess-decimal rejection, whitespace tolerance, signed/empty input, and format round-tripping.
• npx vitest run passes except for a pre-existing, unrelated failure in tests/spend-arc-gateway-usdc.test.ts (missing ../scripts/spend-arc-gateway-usdc.mjs), which fails identically on master.
• ESLint clean on the changed files; tsc --noEmit reports no new errors.

Note (out of scope)

app/api/bridge/rebalance/route.ts uses the same parseFloat / amountNum.toString() pattern and would benefit from the shared helper too. Left out to keep this PR focused on #41.