fix: Reject NaN and Infinity as Number coercion results

Double.parseDouble accepts "NaN", "Infinity", and "-Infinity", which
are not valid JSON numbers. They would slip past NumberSchema coercion
and bypass numeric constraint validation (any comparison with NaN is
false). Reject non-finite results with the same type error used for
other coercion failures.

Author: thced

src/main/java/com/retailsvc/http/internal/ValueCoercion.java

@@ -23,12 +23,18 @@ public static Object coerce(String raw, Schema schema, String pointer) {
         }
       }
       case NumberSchema _ -> {
+        double d;
         try {
-          yield Double.parseDouble(raw);
+          d = Double.parseDouble(raw);
         } catch (NumberFormatException _) {
           throw new ValidationException(
               new ValidationError(pointer, "type", "expected number", raw));
         }
+        if (!Double.isFinite(d)) {
+          throw new ValidationException(
+              new ValidationError(pointer, "type", "expected number", raw));
+        }
+        yield d;
       }
       case BooleanSchema _ -> {
         if ("true".equals(raw)) {

src/test/java/com/retailsvc/http/internal/ValueCoercionTest.java

@@ -60,6 +60,30 @@ void numberCoercionFailureThrowsValidationException() {
         .isInstanceOf(ValidationException.class);
   }
 
+  @Test
+  void rejectsNaNAsNumber() {
+    assertThatThrownBy(() -> ValueCoercion.coerce("NaN", numSchema, "/x"))
+        .isInstanceOf(ValidationException.class)
+        .extracting("error.pointer", "error.keyword")
+        .containsExactly("/x", "type");
+  }
+
+  @Test
+  void rejectsPositiveInfinityAsNumber() {
+    assertThatThrownBy(() -> ValueCoercion.coerce("Infinity", numSchema, "/x"))
+        .isInstanceOf(ValidationException.class)
+        .extracting("error.pointer", "error.keyword")
+        .containsExactly("/x", "type");
+  }
+
+  @Test
+  void rejectsNegativeInfinityAsNumber() {
+    assertThatThrownBy(() -> ValueCoercion.coerce("-Infinity", numSchema, "/x"))
+        .isInstanceOf(ValidationException.class)
+        .extracting("error.pointer", "error.keyword")
+        .containsExactly("/x", "type");
+  }
+
   @Test
   void booleanCoercionFailureThrowsValidationException() {
     assertThatThrownBy(() -> ValueCoercion.coerce("yes", boolSchema, "/b"))