🥅 Reject json0 ops that ot-json0 can only apply - #725

`ot-json0`'s `apply()` quietly treats an op that isn't a real array as a
no-op: it walks the op with `op.length` and numeric indexing, so a bare
component or a plain number iterates zero times and the snapshot comes
back untouched. `backend.submit()` has always accepted those, so they
commit, bump the version and get published, having changed nothing.

Its `compose()` and `invert()` are not so relaxed, though. Both assume a
real array, and throw on anything else:

```
compose({p: ['x'], oi: 1}, fixup)     -> dest.push is not a function
compose({0: {…}, length: 1}, fixup)   -> dest.push is not a function
compose([null], fixup)                -> reading 'p' of null
invert({p: ['x'], oi: 1})             -> op.slice is not a function
```

`$fixup()` composes, and it's called from `apply` middleware, where a
throw is uncaught. So every one of those shapes is a remote crash on any
server that fixes ops up, needing nothing more than a raw socket frame —
no ShareDB client sends them, since `Doc._submit()` runs
`type.normalize()` first, but nothing stops a hand-written one.

This change checks the shape of a submitted op as well as its paths, in
`submit-request` rather than in `ot.apply()`. It has to happen before
the op reaches any type function, and it can't go in `checkOp()`, which
runs before we have the snapshot and so doesn't know the document's
type. Ops we've already committed are deliberately left alone, since
rejecting a historical no-op would make that document unreadable
through `fetchSnapshot()`.

This is an API change: a json0 op that isn't an array used to commit as
a silent no-op, and is now rejected with `ERR_OT_OP_BADLY_FORMED`. That
seems worth it, since the behaviour being removed is a crash for fixup
users and a no-op for everyone else — but it is why three of our own
tests in `test/backend.js` needed their ops wrapping, which is a fair
signal that the shape is easy to write by accident. Clients are
unaffected.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>