[adamtheturtle]

Shared invalid-JSON tests and their body-rejection helper identify the query API by its production hostname. Pass the backend's base_vwq_url fixture into the helper and use it to select the query-specific expectations, including malformed bodies sent with skewed dates. The same assertions can then run at custom service URLs.

This two-file follow-up to #3748 advances #3738, part of #3737. Further URL and backend decoupling remains in #3738.

Validation:

• Python 3.15: 184 targeted cases pass across the in-memory and Flask backends with synthetic credentials and retries disabled. The 113 skips cover real-Vuforia cases and empty-body cases for endpoints that do not take JSON.
• Reused the five existing tests from a separate consumer harness with MockVWS configured at http://127.0.0.1:5006 and http://127.0.0.1:5007: 92 cases pass, with seven expected skips for endpoints that do not take JSON.
• Both changed files have 100% statement and branch coverage across the targeted runs.
• Pre-commit and pre-push hooks pass, including CI partition validation, Mypy, Pyright, public type completeness, Ty, and Pyrefly. Pylint passes for both changed files, and git diff --check passes.

Full-suite coverage and real-Vuforia validation remain for hosted CI.