fix: address PR review feedback for JSON fallback

- Simplify escapeXml() using 'str == null' check (type narrowing)
- Add validation for extracted JSON before passing to specToXml()
- Prevents runtime errors when JSON doesn't match SpecOutput schema

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

apps/server/src/routes/app-spec/generate-spec.ts

@@ -205,7 +205,14 @@ Your entire response should be valid JSON starting with { and ending with }. No
       logger.warn('⚠️ No XML tags found, attempting JSON extraction...');
       const extractedJson = extractJson<SpecOutput>(responseText, { logger });
 
-      if (extractedJson) {
+      if (
+        extractedJson &&
+        typeof extractedJson.project_name === 'string' &&
+        typeof extractedJson.overview === 'string' &&
+        Array.isArray(extractedJson.technology_stack) &&
+        Array.isArray(extractedJson.core_capabilities) &&
+        Array.isArray(extractedJson.implemented_features)
+      ) {
         logger.info('✅ Successfully extracted JSON from response text');
         xmlContent = specToXml(extractedJson);
         logger.info(`✅ Converted extracted JSON to XML: ${xmlContent.length} chars`);