Return JSON 422 for non-JSON validation failures

[kingpy-bot]

Fixes #98.

What changed

• catch Laravel validation failures inside the Passage controller
• return the documented JSON 422 response regardless of Accept headers or session middleware
• preserve the field-level validation errors and stop before any upstream request
• add regression coverage for a plain POST that does not advertise JSON

This keeps ValidatesInboundRequest behavior consistent for webhook and API-gateway clients instead of falling into Laravel's redirect/session response path.

Verification

• focused validation tests: 3 passed, 8 assertions
• vendor/bin/pest: 104 tests passed, 263 assertions
• vendor/bin/pint --test on both touched files: passed
• git diff --check: passed

AI-assisted implementation and verification.