Preventing 500s in agent API routes: enum allowlists + JSON parse hygiene