Fix: prevent client-controlled field injection in message and job creation

[clarboncy]

Summary

Fixes field injection vulnerability in sendMessage() and createJob() where object spread after server-controlled fields allowed clients to override id, status, and sentAt.

Changes

• apps/api/src/services/messageService.js: Moved ...payload before id and sentAt so server values take precedence
• apps/api/src/services/jobService.js: Moved ...payload before id and status so server values take precedence

Before (vulnerable)

const message = { id: `msg_${Date.now()}`, ...payload, sentAt: new Date().toISOString() };
// Client can send id and sentAt in payload to override server values

After (fixed)

const message = { ...payload, id: `msg_${Date.now()}`, sentAt: new Date().toISOString() };
// Server values always take precedence over client input

Closes #9034