fix(crypto): bound public key batch lookups

[rissrice2105-agent]

Summary

• cap public-key batch requests at 100 IDs
• reject malformed JSON, non-string IDs, blank IDs, and oversized values
• trim and deduplicate IDs before service-role database lookups
• add regression coverage for oversized, malformed, invalid, and duplicate-filled batches

Fixes #228

Testing

• vitest run src/app/api/crypto/public-keys/route.test.js (6 tests)
• targeted ESLint
• git diff --check