feat(server): introduce Zod request validation, starting with MCP tools

Adds Zod as the validation library for apps/server (in place of
express-validator), scoped here to a low-risk slice rather than a
full migration:

- MCP tool-call arguments (apps/server/src/api-mcp) are now validated
  end to end. Every tool's inputSchema is generated from its Zod
  schema via z.toJSONSchema() instead of hand-maintained JSON Schema
  literals, and every handler now parses its arguments before use —
  previously every handler did an unchecked `args as SomeType` cast
  with no runtime validation at all.
- A new validate.ts middleware (validateBody/validateParams) replaces
  the express-validator chokepoint for two reference routers, session
  and url-presets, demonstrating the pattern the remaining ~11 routers
  will follow in later PRs.
- An oxlint no-restricted-imports guardrail keeps zod importable only
  from apps/server, so it can never leak into the apps/client bundle.

The bulk of the REST router migration (automation, rundown, and the
rest of api-data) is intentionally left for follow-up PRs to keep this
change reviewable.

apps/server/src/api-data/session/session.validation.ts

@@ -1,15 +1,14 @@
-import { body } from 'express-validator';
+import { z } from 'zod';
 
-import { requestValidationFunction } from '../validation-utils/validationFunction.js';
+import { validateBody } from '../validation-utils/validate.js';
 
-export const validateGenerateUrl = [
-  body('baseUrl').isString().trim().notEmpty(),
-  body('path').isString().trim().notEmpty(),
-
-  body('authenticate').isBoolean(),
-  body('lockConfig').isBoolean(),
-  body('lockNav').isBoolean(),
-  body('preset').optional().isString().trim().notEmpty(),
-
-  requestValidationFunction,
-];
+const generateUrlSchema = z.object({
+  baseUrl: z.string().trim().min(1),
+  path: z.string().trim().min(1),
+  authenticate: z.boolean(),
+  lockConfig: z.boolean(),
+  lockNav: z.boolean(),
+  preset: z.string().trim().min(1).optional(),
+});
+export type GenerateUrlInput = z.infer<typeof generateUrlSchema>;
+export const validateGenerateUrl = validateBody(generateUrlSchema);