[ANAMASGARD]

POST /monitor/message could return HTTP 200 when required level or message fields were missing or empty. The Theia handler ended the response before setting 400 and then continued into the success response; the VS Code monitor also returned success for these requests.

Both handlers now set HTTP 400 before ending the response and return immediately. Existing authorization and valid-message behavior remain unchanged.

Adds 52 HTTP regression tests across both implementations, covering invalid bodies, JSON parsing, authorization, and standard/fullscreen message delivery. Test sources and generated test output are excluded from the VS Code extension package.

Validation:

• 52/52 HTTP tests passed, with the status-code regression reproduced against both original handlers before the fix.
• Full Theia build and lint passed.
• VS Code monitor lint and development/production builds passed.
• Formatting, whitespace, and package-content checks passed.
• No dependency or lockfile changes.

Validation used local HTTP integration with captured UI callbacks; no live IDE session or Kubernetes deployment was used. Existing unrelated lint and third-party webpack warnings remain.

Fixes #431

[jfaltermeier]

Thanks, LGTM! The license check CI errors are caused by the PR coming from a fork. This is unrelated to this change and should pass once merged.