- parseSlashCommandPayload JSON branch now validates required fields
(token, team_id, channel_id, user_id, command) like the form-encoded
branch, preventing runtime exceptions on malformed JSON payloads
- normalizeCallbackPath() ensures leading '/' to prevent malformed URLs
like 'http://host:portapi/...' when callbackPath lacks a leading slash
- Applied in resolveSlashCommandConfig and resolveCallbackUrl
Addresses Codex review round 3 (P2 items).