feat: Zod validation on all API inputs (PRD §5.2)

26 files with Zod schemas, 27 safeParse calls.
All POST/PATCH handlers now validate input:
- Missing required fields → 400 with structured error
- Invalid types (string vs number) → 400
- Out-of-range values (probability >100, negative amounts) → 400
- Valid data still works (behavior preserved)

Pattern: schema.safeParse(await req.json()) → 400 on failure

src/app/api/aos/kb/generate/route.ts

@@ -1,21 +1,26 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
 import { db } from '@/lib/db'
 import ZAI from 'z-ai-web-dev-sdk'
 
 export const dynamic = 'force-dynamic'
 export const maxDuration = 60
 
+const generateKbSchema = z.object({
+  topic: z.string().min(1),
+  category: z.string().optional(),
+  audience: z.enum(['internal', 'client', 'public']).optional(),
+})
+
 // POST /api/aos/kb/generate
 // AI-drafts a knowledge-base article from a brief/topic.
 // Structured output (Zod-validated), markdown content.
 export async function POST(req: Request) {
-  const { topic, category, audience } = (await req.json()) as {
-    topic: string
-    category?: string
-    audience?: 'internal' | 'client' | 'public'
+  const parsed = generateKbSchema.safeParse(await req.json())
+  if (!parsed.success) {
+    return NextResponse.json({ error: 'validation failed', details: parsed.error.flatten() }, { status: 400 })
   }
-
-  if (!topic?.trim()) return NextResponse.json({ error: 'topic required' }, { status: 400 })
+  const { topic, category, audience } = parsed.data
 
   const sys = `Du bist ein technischer Redakteur einer deutschen Software-Agentur (Nordlicht Digital).
 Schreibe einen Wissensdatenbank-Artikel in Markdown.