Validate J0dI3 troopId format before proxying requests

[jeromehardaway]

Problem

src/lib/j0di3-proxy.ts:14-19 checks if (!troopId) but does not validate the format. If a malformed value sneaks through (from a stale session, botched migration, etc.), the downstream J0dI3 API call fails with a generic 4xx/5xx that surfaces to the user as an unhelpful error.

Expected behavior

Proxy layer rejects obviously-invalid troopIds with a specific user-actionable message before making the external call.

Acceptance criteria

• Validate troopId against expected format (UUID v4, based on J0dI3 convention — confirm with backend owner).
• On invalid: return 400 with a message like "Your troop profile is invalid. Sign out and back in to refresh it."
• Log the invalid value (redacted) so we can investigate how it got there.

Suggested approach

const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
if (!troopId || !UUID_RE.test(troopId)) {
  return res.status(400).json({
    error: "Invalid troop profile. Please sign out and sign back in."
  });
}