Parse the request body once per request in the validators

[adamtheturtle]

Closes #3371.

The per-route validator chains (#3562) and the single database resolution (#3526) covered the applicability and route-table halves of the issue. This PR covers the remaining half: the body was still parsed by every validator which read it.

Services validators. ValidatorContext gains two cached properties, request_json and decoded_image. The JSON validators check that request_json can be computed and translate the failure into the route's error, and every later validator reads the parsed object rather than calling json.loads itself. The image validators share one base64 decode instead of four. validate_image_encoding reports a decode failure from the same cached decode the later image validators use.

Query validators. parse_multipart now returns a MultipartForm of plain field strings and file bytes, so the parse is not tied to consumable FileStorage streams. run_query_validators parses once, immediately after the Content-Type header validator which checks the boundary, and passes the form to the eight body validators. It returns a ValidatedQuery holding the parsed form and the database which validate_authorization matched, and get_query_match_response_text takes that instead of re-parsing the body and re-resolving the database. validate_project_state takes the database rather than resolving it a third time.

Error precedence is unchanged. The order of every validator is as it was, and the parse for the Query API happens at the point where the first body-reading validator used to parse.

Tested locally against the non-real backends: test_query, test_add_target, test_update_target, test_invalid_json, test_unexpected_json, test_vumark_generation_api, test_reco_counts_report, test_target_validators and test_requests_mock_usage all pass. prek including the manual pylint stage and the pre-push type checkers passes.

🤖 Generated with Claude Code