fix: reject out-of-range coordinates in Google text-search proxy

[prajwal-raj]

/api/google/text-search validated that lat and lon were finite, but not that
they were actual coordinates. Anything finite got forwarded to Google Places,
so an out-of-range value spent quota on a request that could never return a
useful result.

This adds a bounds check right after the existing finite check: latitude has
to be within [-90, 90] and longitude within [-180, 180], otherwise the route
returns 400 before contacting Google. Valid coordinates are unaffected.

Scope note: issue #19 also mentions auth and rate limits for exposed use.
That is a broader concern shared across the other Google and OpenAI proxy
routes (#16, #17, #18), so I kept this PR to the coordinate-validation half,
which is the self-contained correctness fix. Using Refs rather than Closes so
the auth part can stay tracked.

Refs #19

Testing

• npm run build and npm test are both green (2587 tests, 0 failures).
• npm run test:track: 99/100 on the pinned Chrome-for-Testing v145. The single
  failure is the pre-existing ground-3d probe tracked in test:track: ground-3d probe expects 4 sampleHeight calls but only makes 3 (fails on clean main) #44, unrelated to this
  change and reproducible on a clean main.
• Verified by hand against a running dev server:
  • lat=999 and lon=-200 both return 400 with "lat must be within [-90, 90]
    and lon within [-180, 180]", with no upstream call made.
  • valid coordinates (lat=12.97, lon=77.59) pass the check and reach Google
    as before.