#1195 serve: a POST /settings body without "defaults" must not clear every …

说明

…setting

req.get("defaults") returns None both when the key is absent and when it is explicitly null, and set_shared documents None as "clients use their own settings again". A body the endpoint does not recognise therefore cleared every shared setting and deleted strata-<model>.shared-settings.json, answering 200 OK with no error. The natural mistake is the one this fixes: POST {"max_tokens": 9000} without the "defaults" wrapper the web app always sends.

Require the key and answer 400 when it is missing; {"defaults": null} still clears them, as documented. serve/web/app.js:1010 already sends the right shape, so the web app is unaffected.

Test: SharedSettings.test_a_body_without_the_defaults_wrapper_is_rejected. It fails with "200 != 400" before the change and passes after; the other 6 tests of that class still pass. The 268-test serve suite is unchanged (its single failure in test_responses/test_json_schema_text_format is pre-existing: it fails the same way without this change).

Rebased onto the new `main` after the history cleanup. Replaces #1031.