A client value that overflowed a Signal[T]'s narrower numeric type (e.g. 9999
into Signal[int8]) was silently truncated, and a shape mismatch was silently
dropped — the typed Signal was only as safe as a best-effort decode.

Add WithStrictDecode(): a client value that overflows the target int/uint/float
width or whose JSON shape doesn't match the field surfaces an action error and
the handler does not run, so corrupt input can't reach server state. Off by
default (best-effort decode preserved). The decode is factored into
decodeScalarChecked, which reports the error; decodeScalarInto wraps it and
discards it so server-side store decodes keep the lenient contract. The
struct-tag init path stays best-effort (author input, not untrusted client).