bug(a2a-server): express.json registered after A2A routes, req.body undefined

## What happened?

`packages/a2a-server/src/http/app.ts:280-282` mounts A2A JSON-RPC routes before the body parser:

```ts
const appBuilder = new A2AExpressApp(requestHandler, customUserBuilder);
expressApp = appBuilder.setupRoutes(expressApp, '');
expressApp.use(express.json());
```

Handlers from `setupRoutes` run before `express.json()`, so `req.body` is `undefined` for `message/send` / `tasks/*`. Custom `/tasks` and `/executeCommand` only work because they are defined later. Order-dependent and fragile.

## What did you expect to happen?

Register `expressApp.use(express.json())` (and `requestStorage.run`) before `setupRoutes`, with a regression test POSTing JSON-RPC verifying `req.body` is parsed.

## Client information

- Repo `google-gemini/gemini-cli` @ `main` `9c1b0a610`
- Area `packages/a2a-server/src/http/app.ts:275-284`
- Platform: A2A server

## Login information

N/A — repro with supertest POST JSON to A2A route asserting body defined.

## Anything else we need to know?

Fix direction: move `express.json()` above `setupRoutes`; verify `/tasks`, `/executeCommand`, and A2A routes all parse. Already-correct pattern at `/executeCommand` shows intent.

Start in packages/a2a-server/src/http/app.ts around lines 275-284 and inspect the order of requestStorage.run, express.json(), and setupRoutes. Add or update a supertest regression covering JSON-RPC POST requests, then verify that A2A routes, /tasks, and /executeCommand all receive parsed request bodies.

Written by the indexing model from the issue text.