feat: Zod validation on all API inputs (PRD §5.2)

26 files with Zod schemas, 27 safeParse calls.
All POST/PATCH handlers now validate input:
- Missing required fields → 400 with structured error
- Invalid types (string vs number) → 400
- Out-of-range values (probability >100, negative amounts) → 400
- Valid data still works (behavior preserved)

Pattern: schema.safeParse(await req.json()) → 400 on failure

src/app/api/aos/contracts/[id]/sign/route.ts

@@ -1,9 +1,14 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
 import { db } from '@/lib/db'
 import { randomBytes, createHash } from 'crypto'
 
 export const dynamic = 'force-dynamic'
 
+const signContractSchema = z.object({
+  signedBy: z.string().optional(),
+})
+
 // Extract the real client IP from the request (behind Caddy/proxy).
 function getClientIp(req: Request): string {
   const headers = new Headers(req.headers)
@@ -31,7 +36,11 @@ export async function PATCH(
   { params }: { params: Promise<{ id: string }> }
 ) {
   const { id } = await params
-  const body = (await req.json().catch(() => ({}))) as { signedBy?: string }
+  const parsed = signContractSchema.safeParse(await req.json().catch(() => ({})))
+  if (!parsed.success) {
+    return NextResponse.json({ error: 'validation failed', details: parsed.error.flatten() }, { status: 400 })
+  }
+  const body = parsed.data
 
   const contract = await db.contract.findUnique({ where: { id } })
   if (!contract) return NextResponse.json({ error: 'not found' }, { status: 404 })