feat(api): implement runtime zod request validation

[0xDeon]

Summary

Replaces unsafe manual if (!field) guards in auth routes with a reusable Zod-powered validation middleware that returns structured 400 responses.

Validation Architecture

A single validate(schema) middleware factory in src/middleware/validate.ts wraps any Zod schema. On failure it returns:

{ "error": "Validation failed", "issues": [{ "field": "walletAddress", "message": "walletAddress is required" }] }

On success it replaces req.body with the parsed (type-safe) data and calls next().

Middleware Design

• validate(schema) returns a standard Express RequestHandler (3-arg)
• Uses schema.safeParse() — never throws
• issues[].field is the dot-joined Zod path (e.g. nested.field)

Routes Migrated

Route	Schema
POST /auth/challenge	ChallengeSchema — requires walletAddress: string
POST /auth/verify	VerifySchema — requires walletAddress, signature, nonce

Schemas live in src/schemas/auth.schemas.ts for maintainability.

Tests Added

src/__tests__/validate.test.ts — 6 test cases:

• Valid input passes through with correct body
• Missing required field → 400 structured error
• Wrong type (string for number) → 400 structured error
• Empty body → 400 structured error
• Issues array entries have field + message keys
• Middleware returns a 3-arg Express handler

All 17 tests pass. Lint clean.

Fixes #20

[drips-wave]

@0xDeon Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[codebestia]

LGTM!
Thanks