feat: Zod validation on all API inputs (PRD §5.2)

26 files with Zod schemas, 27 safeParse calls.
All POST/PATCH handlers now validate input:
- Missing required fields → 400 with structured error
- Invalid types (string vs number) → 400
- Out-of-range values (probability >100, negative amounts) → 400
- Valid data still works (behavior preserved)

Pattern: schema.safeParse(await req.json()) → 400 on failure

src/app/api/aos/tasks/[id]/comments/route.ts

@@ -1,8 +1,14 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
 import { db } from '@/lib/db'
 
 export const dynamic = 'force-dynamic'
 
+const createCommentSchema = z.object({
+  body: z.string().min(1),
+  author: z.string().optional(),
+})
+
 // GET /api/aos/tasks/[id]/comments — list comments on a task
 export async function GET(
   _req: Request,
@@ -23,8 +29,11 @@ export async function POST(
 ) {
   try {
     const { id } = await params
-    const { body, author } = (await req.json()) as { body: string; author?: string }
-    if (!body?.trim()) return NextResponse.json({ error: 'body required' }, { status: 400 })
+    const parsed = createCommentSchema.safeParse(await req.json())
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'validation failed', details: parsed.error.flatten() }, { status: 400 })
+    }
+    const { body, author } = parsed.data
 
     const comment = await db.taskComment.create({
       data: { taskId: id, body: body.trim(), author: author ?? 'Max Brandt' },