#1664 serve: a content part the server does not read is a 400 on chat and messages, as on responses

Descripción

## Summary
On `/v1/chat/completions` a `file` or `input_audio` part, and on `/v1/messages` a `document` block (also inside a `tool_result`), were dropped without a word. The request got a 200 and the model answered about a file it never saw. `/v1/responses` already refuses the same input; chat and messages now give the same 400, naming where the part is.

## What changed
- `serve/frontend.py`: `_check_parts` runs while a request is converted, e.g. `messages[2].content[1].type: content parts of type 'document' are not supported (text and images are)`. Text, images, thinking, tool_use and tool_result read as before. `redacted_thinking` is still dropped (another server's encrypted reasoning). A chat `refusal` part now reads as its text, as on `/v1/responses`.
- `serve/test_frontend.py`: seven tests, one of them checking that text and image requests render the same prompt as before.

## Extra Notes
- The 6 new cases fail before the change. After it, test_frontend, test_server, test_responses and test_request_hardening pass (macOS, Python 3.14).
- If you prefer to keep dropping some types, I can do that with a printed warning instead.
- I used Claude Code to find this and draft the change. I ran the tests myself.