feat: Zod validation on all API inputs (PRD §5.2)

26 files with Zod schemas, 27 safeParse calls.
All POST/PATCH handlers now validate input:
- Missing required fields → 400 with structured error
- Invalid types (string vs number) → 400
- Out-of-range values (probability >100, negative amounts) → 400
- Valid data still works (behavior preserved)

Pattern: schema.safeParse(await req.json()) → 400 on failure

src/app/api/aos/webhooks/route.ts

@@ -1,4 +1,5 @@
 import { NextResponse } from 'next/server'
+import { z } from 'zod'
 import { db } from '@/lib/db'
 import { randomBytes } from 'crypto'
 
@@ -14,6 +15,11 @@ const KNOWN_EVENTS = [
   'test.event',
 ]
 
+const createWebhookSchema = z.object({
+  url: z.string().min(1).startsWith('https://'),
+  events: z.array(z.string()).min(1),
+})
+
 // GET /api/aos/webhooks — list registered webhooks
 export async function GET() {
   const webhooks = await db.webhook.findMany({ orderBy: { createdAt: 'desc' } })
@@ -37,11 +43,11 @@ export async function GET() {
 // POST /api/aos/webhooks — register a webhook (generates a real HMAC secret)
 export async function POST(req: Request) {
   try {
-    const { url, events } = (await req.json()) as { url: string; events: string[] }
-
-    if (!url?.trim()) return NextResponse.json({ error: 'url required' }, { status: 400 })
-    if (!url.startsWith('https://')) return NextResponse.json({ error: 'url must be https' }, { status: 400 })
-    if (!events?.length) return NextResponse.json({ error: 'at least one event required' }, { status: 400 })
+    const parsed = createWebhookSchema.safeParse(await req.json())
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'validation failed', details: parsed.error.flatten() }, { status: 400 })
+    }
+    const { url, events } = parsed.data
 
     const invalid = events.filter((e) => !KNOWN_EVENTS.includes(e) && e !== '*')
     if (invalid.length) return NextResponse.json({ error: `invalid events: ${invalid.join(', ')}`, valid: KNOWN_EVENTS }, { status: 400 })