fix: Replace NULL sentinels in form data and tolerate malformed validation errors

[razor-x]

What

Two small hardening fixes from the SDK audit's L5 grab-bag:

NULL in form data (L5c). The client's request override applied replace_null to json= bodies and search params but not to data= — so the documented NULL sentinel form-encoded via str() as the literal string "NULL". No generated route uses data=, but it is part of the documented seam.client.post(...) escape hatch. Mapping-shaped data= now gets the same replace_null pass in both clients (name=NULL&kept=value → name=&kept=value).

Malformed validation_errors shapes (L5d). SeamHttpInvalidInputError trusted the server's validation_errors envelope: a list/string envelope, or a parameter entry that isn't a dict, raised AttributeError from inside the accessors — and the validation_errors property added in #631 walks every key, so a single oddly-shaped entry blew up the whole accessor. Both accessors now degrade to "no validation details" ([]) for anything but the expected object-of-objects shape, while well-formed entries next to malformed ones still surface.

Also teaches the test suite's recording server to record form-encoded bodies as text instead of failing to JSON-parse them.

Testing

New test/null_data_test.py: wire assertion that the sentinel form-encodes as an empty value; list/string envelopes and non-dict/non-list parameter values return [] without raising, with well-formed siblings intact.

Revert check: with seam/client.py and seam/exceptions.py reverted, the tests fail with the audit's symptoms — name=NULL&kept=value on the wire and AttributeError: 'list' object has no attribute 'get'.

Full suite: 190 passed; mypy, pylint (10.00), black clean.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Y1RzepycXEYA3LStfjt8cY

---

Generated by Claude Code