#592 serve: a malformed "tools" value kills the request thread (connection reset / 502 instead of a 400)

Description

**What happens.** A request whose `tools` is not a list of tool objects takes the request thread down with an
`AttributeError`. The connection closes with no reply at all — the same request through a reverse proxy shows as
`502`. A `400` naming the bad field would be right.

Seen on Windows, Strata 0.1.38, engine IQ3_XXS, 128K context, OpenAI endpoint, client on another PC.

**Where.** Two places, one line apart (both still on `main`):

- `serve/frontend.py:185` — an entry that is not `{"type": "function", ...}` is handed on unchanged:
  ```python
  tools = [t.get("function", t) if isinstance(t, dict) and t.get("type") == "function" else t
           for t in req.get("tools") or []] or None
  ```
- `serve/server.py:2422` — the next consumer assumes every entry is a mapping:
  ```python
  own = {t.get("name") for t in tools or []}
  ```

**Traceback** (the server's own console):

```
Exception occurred during processing of request from ('192.168.31.12', 40386)
Traceback (most recent call last):
  ...
  File "E:\AI\Strata-main\serve\server.py", line 2422, in _openai
    own = {t.get("name") for t in tools or []}
AttributeError: 'str' object has no attribute 'get'
```

**Reproduce.** Any of these:

```sh
curl -X POST http://127.0.0.1:8080/v1/chat/completions -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"hi"}],"tools":"auto","max_tokens":8}'
curl -X POST http://127.0.0.1:8080/v1/chat/completions -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"hi"}],"tools":["get_weather"],"max_tokens":8}'
curl -X POST http://127.0.0.1:8080/v1/chat/completions -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"hi"}],"tools":[{"name":"get_weather"}],"max_tokens":8}'
```

Expected: `400` saying what is wrong with `tools`.
Observed: no reply; the traceback above; the server itself stays up and the next request is answered normally.

**The Anthropic path is the same shape**, one line up at `serve/frontend.py:235`, where `t["name"]` on a string
raises `TypeError: string indices must be integers` for the same kind of input.

**Suggested fix.** Refuse a malformed `tools` where the request is parsed — `openai_to_messages` /
`anthropic_to_messages` already raise `ValueError` for other fields, and the caller turns that into a `400` — and
guard the consumer as a second line of defence:

```python
own = {t.get("name") for t in tools or [] if isinstance(t, dict)}
```

I hit this from a client that put the wrong value in `tools` by mistake; the connection reset made it look like the
engine had died, so the clean `400` would have saved some hunting.