fix: harden share bot uploads

lib/share/validation.test.ts

@@ -24,8 +24,9 @@ describe("share validation", () => {
       throw new Error("Expected blank text to fail");
     } catch (error) {
       expect(error).toBeInstanceOf(ShareHttpError);
-      expect((error as ShareHttpError).status).toBe(422);
+      expect((error as ShareHttpError).status).toBe(400);
     }
+    expect(() => validateShareText("before\0after")).toThrow("NUL");
   });
 
   test("measures the text limit in UTF-8 bytes", () => {
@@ -65,7 +66,12 @@ describe("share validation", () => {
           type: "text/plain",
         })
       )
-    ).rejects.toMatchObject({ status: 422 });
+    ).rejects.toMatchObject({ status: 400 });
+    await expect(
+      validateTextFile(
+        new File(["before\0after"], "nul.txt", { type: "text/plain" })
+      )
+    ).rejects.toMatchObject({ status: 400 });
   });
 
   test("validates image contents instead of trusting the MIME type", async () => {