test(core): cover defineEndpoint's no-second-argument request-parsing path

Every existing test in endpoint-schema.test.ts passed rawInput
explicitly, so the branch added to endpoint.ts's fix (GET/HEAD query
parsing, JSON body parsing, malformed/absent body fallback) was
exercised by nothing but a manual curl. Add coverage that calls the
endpoint with only a context, matching the real router's calling
convention:

- GET with query parameters populates input from ctx.url.searchParams.
- POST with a JSON body populates input from the parsed body.
- POST with a malformed or absent body does not throw; the schema's
  own validation decides the outcome (asserted on the real response).
- An explicit rawInput argument still wins and the request is never
  read (the body is drained first, so a second .json() call would
  reject if the endpoint tried to read it again) -- the regression
  guard for the branch intentionally left untouched.

Confirmed the GET and POST-body tests fail against the pre-fix
endpoint.ts (input resolves as undefined/null instead of the sent
value); the malformed/absent-body test does not distinguish pre- and
post-fix, because in that specific edge case both normalize to an
effectively empty input -- noted in the report rather than forced.

Added a CHANGELOG entry documenting the behavior change for
downstream apps: a request that previously passed vacuous validation
on a defineEndpoint route can now legitimately fail.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,18 @@
 # Changelog
 
+## Unreleased
+
+- Fixed `defineEndpoint` (`@wrnexus/core`) so routes invoked through the real HTTP router
+  (which calls handlers as `handler(ctx)`, with no second argument) actually receive their
+  request input: it now parses query parameters for GET/HEAD and the JSON body otherwise
+  when no input is passed explicitly. Previously such endpoints silently validated
+  `undefined`, so an `input` schema with only optional fields passed vacuously regardless of
+  what was sent. **Behavior change for downstream apps:** a request that previously passed
+  vacuous validation on a `defineEndpoint` route can now legitimately fail (400
+  `VALIDATION_ERROR`) if it does not actually satisfy the schema. Explicitly passing a second
+  argument (e.g. from a unit test or an internal caller) is unaffected and still takes
+  priority over reading the request.
+
 ## 0.8.8
 
 - Added the framework request context to `.wrn` language-server type environments.