fix(validation): apply the max_tokens guard on Solana, reject bool across all three numeric validators

[VickyXAI]

Closes #31.

Three commits: the Solana max_tokens gap, the bool gap across all three numeric validators, and the tests for the second one.

The Solana half

validate_max_tokens was called from client.py and nowhere else. solana_client.py imported three sibling validators but not this one, and put the caller's value straight into paid request bodies at four chat entry points — solana_client.py:713, :817, :3009, :3061.

So max_tokens=2_000_000 raised a ValueError on Base and was signed and sent on Solana. That matters more than a missing guard usually would: the gateway does not reject an over-ceiling max_tokens, it clamps to the model ceiling and charges for the clamped value. There was no server-side backstop behind the missing client-side one.

The bool half

bool is an int subclass, so isinstance(True, int) is True. All three numeric validators let it through, and the value serialized to the wire as JSON true/false:

validate_max_tokens(True)    -> passed, wire carried "max_tokens": true
validate_temperature(True)   -> passed
validate_top_p(False)        -> passed

A flag threaded into the wrong keyword is the same mistake regardless of which keyword it lands in. All three reject it now, with a message naming bool rather than a bare "must be a number" — the caller passed True deliberately and needs to know that this specific type is the problem.

Verification

418 pass; black and ruff clean; 3.9 / 3.11 / 3.12 green.

The Solana tests use a transport that raises on contact, so validation must reject before a request is built — a passing test proves nothing reached the network. They also assert real ceilings (128000, 262144) still pass on both chains, and that Base and Solana share one bound. Guarded with importorskip so the 3.9 job, which installs without the solana extra, stays green.

Mutation-verified rather than assumed:

mutation	result
drop the max_tokens bool check	2 fail
drop one Solana validate_max_tokens call	4 fail
drop all four Solana calls	5 fail
drop the temperature + top_p bool guards	2 fail

That last row is why the third commit exists. 9590816 claimed "Tests cover both booleans on all three validators" but touched only validation.py — no test file. Deleting both of its new guards left all 414 tests green. The fix was real; the coverage was not.

Stacked on fix/max-tokens-clamp-disclosure (#32) — merge that first.