Auth Flow API Returns 500 internal error when the request body is invalid/not properly formatted

**Describe the bug**
I ran a few invalid inputs intentionally to help me with documenting the Authentication Flow API error responses.

In the process, I ran into the following issue:

Improper inputs such as poorly formatted JSON (e.g including a trailing comma in JSON) will return a 500 internal error that looks like this:

```
"error": {
"name": "InternalError",
"reason": "UnexpectedError",
"message": "unexpected error occurred",
"code": 500
}
```

**Authgear Version**
- Version: SaaS

**To Reproduce**
Steps to reproduce the behavior:
1. Initiate an HTTP request to the authentication flow endpoint (`/api/v1/authentication_flows/states/input`)
2. Add a trailing comma to anywhere in the request body like so:
```
{
"state_token": "authflowstate_ZK9ZENACTQDGNM1B2741CREF0ZBRR9WD",
"input": {
"index": 0,
}
}
```
4. Send the request
5. See error in HTTP response.

**Expected behavior**
Expect an error message about invalid input

**Screenshots**

**Client Env (if applicable, please complete the following information):**
- Device: [e.g. Desktop, Smartphone]
- OS: [e.g. Windows, iOS]
- Browser [e.g. chrome, safari]
- Browser Version [e.g. 22]

**Additional context**
Add any other context about the problem here.

Start by reproducing the malformed JSON request against /api/v1/authentication_flows/states/input, using the trailing-comma example in the issue. Trace how the endpoint handles the decode failure and verify that invalid request bodies return an invalid-input error rather than the shown 500 InternalError response.

Written by the indexing model from the issue text.