test: Add edge case for handleValidateBootstrapToken invalid JSON

Tests invalid JSON body triggers json.Decode error and returns 400.
Coverage: 90.5% to 100%.

internal/api/bootstrap_token_test.go

@@ -1,9 +1,12 @@
 package api
 
 import (
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"runtime"
+	"strings"
 	"testing"
 
 	"github.com/rcourtman/pulse-go-rewrite/internal/config"
@@ -388,6 +391,26 @@ func TestBootstrapTokenValid(t *testing.T) {
 	})
 }
 
+func TestHandleValidateBootstrapToken_InvalidJSON(t *testing.T) {
+	tmpDir := t.TempDir()
+	cfg := &config.Config{DataPath: tmpDir}
+	r := &Router{config: cfg}
+	r.initializeBootstrapToken()
+
+	// Test invalid JSON body triggers json.Decode error
+	req := httptest.NewRequest(http.MethodPost, "/api/security/validate-bootstrap-token", strings.NewReader("not valid json"))
+	rr := httptest.NewRecorder()
+
+	r.handleValidateBootstrapToken(rr, req)
+
+	if rr.Code != http.StatusBadRequest {
+		t.Errorf("expected 400 for invalid JSON, got %d", rr.Code)
+	}
+	if !strings.Contains(rr.Body.String(), "Invalid request payload") {
+		t.Errorf("expected 'Invalid request payload' error, got %q", rr.Body.String())
+	}
+}
+
 func TestClearBootstrapToken(t *testing.T) {
 	t.Run("nil router does not panic", func(t *testing.T) {
 		var r *Router = nil