fix(api): validate create request bodies

[codemountains]

Summary

• validate POST /v1/endpoints request bodies with an API-local Zod schema
• validate POST /v1/tokens request bodies against the current name contract
• return structured invalid_request / HTTP 400 responses for non-object JSON and invalid field types
• preserve existing endpoint mode errors, malformed JSON handling, omitted bodies, and JSON {} behavior

Why

The request readers previously cast any JSON object to the shared TypeScript request types. Invalid values such as { "name": 123 } were silently treated as an omitted name, while JSON primitives and arrays could continue into authentication or creation logic.

The schemas remain in the API presentation layer because they currently have no runtime consumer outside the API. This avoids adding Zod as a shared-package runtime dependency.

TDD

Red:

• added endpoint/token route tests for invalid name values and non-object JSON bodies
• confirmed 12 new cases failed with the prior 201/401 behavior

Green/refactor:

• added the smallest request-boundary validation and route error mapping needed to pass
• added characterization tests for omitted bodies and JSON {} after code review

Verification

• focused API tests: 3 files, 42 tests passed
• just ci-full: passed
  • typecheck, Biome, Markdown lint
  • 49 unit test files, 340 tests
  • coverage thresholds
  • Worker dry-run and OpenTofu validation/tests
  • smoke E2E
• just test-e2e: 1 file, 5 tests passed
• code-reviewer: no remaining findings; initial Low test-gap finding addressed

Documentation

No documentation changes are required. This enforces the existing shared request contracts and does not implement the broader PAT scope, expiration, or idempotency requirements.

Closes #99