#1663 serve: a sampling field of the wrong type is a 400 that names it

说明

## Summary
A request with `"temperature": "0.7"`, `"top_k": 40.0` or `"seed": true` got a 200 and a greedy reply. The bad value replaced the configured default in `run()`'s merge, then `sampling_keys` dropped it as not a number. Now it is a 400 that names the field, as POST /settings and the run config already do.

## What changed
- `serve/server.py`: `check_request_sampling(req)` checks types only (a number for temperature, top_p, min_p and the penalties; an integer for top_k, penalty_last_n and seed; never bool). Chat, messages, count_tokens and responses call it before anything is sent.
- `serve/test_request_hardening.py`: a wrong type gets 400 on each endpoint; in-type values of any range and null fields still get 200.

Ranges and every well-typed request behave as before.

## Extra Notes
- The 10 new refusal cases fail before the change (200 != 400). After it, test_request_hardening, test_server, test_frontend and test_responses pass (macOS, Python 3.14).
- If you prefer, I can keep the configured default for a bad field and print a warning instead.
- I used Claude Code to find this and draft the change. I ran the tests myself.