Add centralized request-schema validation framework

[pavsoss]

Summary

Part 1 of 2 for #1024. Request validation was duplicated across handlers, each
re-checking body shape, field presence, types and allowed values inline and
returning its own error. This centralizes the contract: every endpoint declares
a schema once, and a single decorator enforces it before the handler runs.

Invalid requests now get a typed error that lists every offending field in
one response instead of stopping at the first problem. Per-field code and
message overrides mean migrated endpoints return exactly the errors they did
before, so existing clients see no change in accepted or rejected inputs.

jsonschema is not a project dependency and none is added; the validator is a
small in-house implementation covering presence, type, enum and length, plus
lenient query-parameter coercion that matches the previous behaviour. The
existing XSS/auth decorators are unchanged and still run.

Migrated: /predict, /feedback, /feedback/stats, /importance,
/spam-insights. /analyze-email-header registers its contract for reuse but
keeps its file-vs-JSON presence check, which a flat body schema can't express.

Parts

• Part 1 of 2 (this PR) — validation framework and endpoint migration.
  Targets the default branch.
• Part 2 of 2 ([Refactor]: Centralized request-schema validation wired to the OpenAPI spec #1024) — OpenAPI request contract generated from the same
  schemas, stacked on top of this.

Test plan

• New coverage for the framework: valid payloads pass; an invalid payload is
  rejected with a typed envelope enumerating every bad field; presence, type,
  enum, min/max length, non-object and malformed bodies, the aggregate
  single-code case, and lenient query coercion.
• Existing predict/feedback/error-envelope suites continue to pin the same
  codes, messages and status for each accepted and rejected input.

Refs #1024

[vercel]

@pavsoss is attempting to deploy a commit to the Aditya Sharma's projects Team on Vercel.

A member of the Team first needs to authorize it.