How should API routes classify malformed JSON and unsafe enum casting?