feat(#56): Address PR comments

src/routes/api/pokedexes/[id]/catch-records/+server.ts

@@ -88,12 +88,29 @@ export const POST = async (event: RequestEvent) => {
 	try {
 		const userId = await requireAuth(event);
 		const { id: pokedexId } = event.params;
-		const records: Partial<CatchRecord>[] = await event.request.json();
+		const body: unknown = await event.request.json();
 
 		if (!pokedexId) {
 			return json({ error: 'Pokedex ID is required' }, { status: 400 });
 		}
 
+		if (!Array.isArray(body)) {
+			return json({ error: 'Request body must be an array of catch records' }, { status: 400 });
+		}
+		const invalidIndex = body.findIndex((r) => {
+			if (!r || typeof r !== 'object') return true;
+			const entryId = (r as Partial<CatchRecord>).pokedexEntryId;
+			return entryId === undefined || entryId === null || entryId === '';
+		});
+		if (invalidIndex !== -1) {
+			return json(
+				{ error: `Record at index ${invalidIndex} is missing required field "pokedexEntryId"` },
+				{ status: 400 }
+			);
+		}
+
+		const records = body as Array<Partial<CatchRecord> & Pick<CatchRecord, 'pokedexEntryId'>>;
+
 		const { session } = await event.locals.safeGetSession();
 		if (session) {
 			await event.locals.supabase.auth.setSession(session);