Add targeted tests for remaining decision_api.lua coverage gaps

[levleontiev]

Why

decision_api.lua remains the biggest drag on non-generated Lua coverage. If we want to push the repo closer to 90%, this file is still the highest-leverage target.

Goal

Raise decision_api.lua coverage materially beyond the current post-issue-30 state by targeting the remaining deep unhappy/fallback branches, not more happy-path tests.

Focus areas

1. Body parsing unhappy paths

• malformed JSON body
• non-object JSON payloads
• missing / malformed messages structures
• request-body shapes that should safely degrade instead of crashing

2. IP / header provenance edge cases

• conflicting forwarded headers
• invalid IP values
• empty / duplicated forwarded/header cases
• branches where provenance should degrade safely or normalize values

3. Shadow / would_reject telemetry paths

• decisions that should not block, but must still emit telemetry / would-reject behavior
• header/metadata branches that differ between enforce and shadow

4. Header-hint / token accounting branches

• cases where header hints exist but usage/body data are partial or missing
• branches that reconcile request/response token metadata in unusual shapes

5. Body filter / reconciliation unhappy paths

• absent usage
• malformed usage payloads
• partial usage / response shapes that should not break reconciliation

6. Remaining debug / support edge branches

• only if still uncovered after the above
• cookie / method / secret absence edge cases that are still untested

Non-goals

• more happy-path tests that do not move coverage materially
• broad unrelated coverage work in already healthier files

Acceptance criteria

• New tests target uncovered or weakly-covered branches in decision_api.lua, not generic success paths.
• busted spec/unit/decision_api_spec.lua passes.
• Full busted spec/unit passes.
• lua-quality stays green.
• Coverage report shows a meaningful increase for decision_api.lua versus its current post-issue-30 baseline.