Harden JSON unmarshalling for API payloads (disallow unknown fields)

[emperor42]

Replace json.NewDecoder(r.Body).Decode(&payload) with a decoder that calls decoder.DisallowUnknownFields(). This prevents accidental extra fields from being silently ignored and improves API robustness.