refactor: add centralized Zod validators for all API inputs

Create server/src/lib/validators.ts with reusable schemas for all API
inputs (auth, fights, bets, payments, tournaments, queue, docs).
Import and use in all route handlers, replacing inline validation.
Add formatZodError helper for user-friendly error messages.
77 test cases in validators.test.ts cover valid, invalid, boundary,
and attack inputs (SQL injection, XSS, prototype pollution).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/routes/bets.test.ts

@@ -57,7 +57,7 @@ async function placeBetReq(cashuToken: string, overrides: Record<string, any> =
     headers: { 'Content-Type': 'application/json' },
     body: JSON.stringify({
       fightId: 'test-fight',
-      pubkey: 'deadbeef',
+      pubkey: 'a'.repeat(64),
       botId: 'test-bot',
       amountSats: 100,
       cashuToken,