Stop endpoint treats string "false" as a request to stop all tasks

## Problem

`POST /api/stop` manually coerces the JSON body's `all` field with `bool(body["all"])`. In Python, every non-empty string is truthy, so a client sending `{"all":"false","session_id":"session-1"}` invokes `stop_tasks(clear_all=True, ...)`.

This can terminate every active task even though the caller explicitly supplied `false` and targeted one session.

## Reproduction

1. Send `POST /api/stop` with JSON body `{"all":"false","session_id":"session-1"}`.
2. Observe that `TaskQueueService.stop_tasks` receives `clear_all=True`.

The same issue affects other non-empty false-like values such as `"0"`, `"no"`, and `"off"`.

## Expected behavior

Recognized false-like values must not enable global cancellation. Unrecognized values should be rejected before any stop operation runs. Query-string `all=true` should retain precedence when explicitly supplied.

## Proposed fix

Normalize boolean body values explicitly and add router-level regression tests for false-like, true-like, and invalid values.

Start at the router handling POST /api/stop and trace how the JSON body's all field reaches TaskQueueService.stop_tasks. Add router-level regression tests for false-like, true-like, and invalid values, while confirming query-string all=true retains precedence and invalid input triggers no stop operation.

Written by the indexing model from the issue text.