Add express-validator list middleware

[karilint]

Closes #733

Summary

• add express-validator to the backend dependencies
• introduce middleware-backed request-shape validation for cross-search rows, localities, and export routes
• add a reusable tab-list query validator middleware and apply it to secondary list endpoints:
  • museum localities
  • reference localities/species
  • time-unit localities
  • time-bound time-units
• keep the existing shared validators/parsers for semantic checks and query normalization

Validation

• git diff --check
• npm run lint:backend
• npm run tsc:backend
• cd backend && DOTENV_CONFIG_PATH=../.test.env NODE_OPTIONS='-r dotenv/config' npx jest src/api-tests/crossSearch/get.test.ts src/api-tests/crossSearch/export.test.ts --runInBand --config jest-config.js --detectOpenHandles --forceExit
• cd backend && DOTENV_CONFIG_PATH=../.test.env NODE_OPTIONS='-r dotenv/config' npx jest src/api-tests/tabLists/queryValidation.test.ts --runInBand --config jest-config.js --detectOpenHandles --forceExit
• commit hook before the follow-up: npm run lint and npm run tsc

Notes

This is still intentionally incremental: request-shape validation moves into middleware, while domain-specific validation and query normalization stay with the existing shared services.