fix: harden backend stability and test production utilities

backend/tests/full-audit-regression.js

@@ -199,6 +199,17 @@ async function run() {
       assert.ok(jar.get('csrf_token'));
     });
 
+    test('malformed JSON receives the global JSON error response', async () => {
+      const malformed = await request(baseUrl, new CookieJar(), 'POST', '/api/login', {
+        csrf: false,
+        headers: { 'Content-Type': 'application/json' },
+        body: '{"invalid":}'
+      });
+      assert.strictEqual(malformed.status, 400);
+      assert.strictEqual(malformed.data.success, false);
+      assert.strictEqual(typeof malformed.data.message, 'string');
+    });
+
     test('auth endpoints login with real cookies and enforce CSRF after authentication', async () => {
       const login = await request(baseUrl, jar, 'POST', '/api/login', {
         json: { username: 'admin', password: adminPassword }