fix: add input validation, Zod schemas, rate limiting, and IP trust

- Add Zod schema for webhook response parsing (orchestrator.ts)
- Add Zod schemas for POST /respond and /react request bodies
- Add safe integer validation for batch count param
- Prefer cf-connecting-ip over spoofable x-forwarded-for
- Add ID format validation on URL params
- Add rate limiting on /auth/login (30/min) and /update (10/min)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/package.json

@@ -19,7 +19,8 @@
     "drizzle-orm": "^0.40.1",
     "hono": "^4.7.6",
     "nanoid": "^5.1.5",
-    "nostr-tools": "^2.23.3"
+    "nostr-tools": "^2.23.3",
+    "zod": "^4.3.6"
   },
   "devDependencies": {
     "@types/better-sqlite3": "^7.6.13",