Settings endpoints answer 500 when the body is not an object #797

What happens

Two settings endpoints answer with a server error (500) when the request body is valid JSON but not an object.

• POST /api/settings/stems-location with a body like [].
• POST /api/settings with a body like "x" or 7.

Who it affects

Nobody using the app normally, since the app always sends an object. A script, a browser extension or a mistake in a future change would hit it, and the response is a stack-trace-style 500 instead of a clear answer.

What should happen

A body that is not an object is treated as an empty one, and the endpoint answers the way it does for any missing field.

Found by

Writing tests for the startup and library paths. The failing tests exist and the fix is four lines in app/main.py.