re #15 docs: Validation package guide

[tonydspaniard]

Summary

Validation package documentation, per #15. Single new file: docs/packages/validation.md (~544 lines). Follows the #16 template.

Source observations

• Issue checklist mentioned ~7 rules ("Alpha, CreditCard, Email, IBAN, Ip, ZipCode, Url, etc."). The source actually ships 18: the 7 above plus AlphaNum, Between, Boolean, Callback, DateTime, In, Integer, Isbn, Max, Min, Regex, SwiftBic. All catalogued in the rule table.
• AbstractRule::__invoke short-circuits on first failure for a field — subsequent rules for that field don't execute. Only the first failure message per field is recorded. Documented.
• IbanRule strips the IBAN/IIBAN prefix before checking — user-pasted prefixed values are handled transparently. Documented.
• UnionPay credit cards intentionally skip the Luhn check (the $noLuhn exemption list in CreditCardRule). Documented.
• EmailRule source carries an explicit "this is deliberately basic" comment recommending egulias/EmailValidator. Surfaced in Limitations with the recommendation.
• Validation middleware is NOT a separate class — rules themselves implement Altair\Middleware\Contracts\MiddlewareInterface. There's no ValidationMiddleware for a PSR-15 pipeline; the wiring is by contract, not by a shipped class. Documented honestly.

Test plan

• Render and skim
• Pure additive docs