Validate every request body at the boundary

Adds schema validation to every route that reads user input, with tests for bad input.

Last checked against the current Claude Code facts on 2026-11-07.

More security prompts

• Move every hard-coded secret out of the code
• Fix high-severity dependency vulnerabilities

New to /goal? Read Let Claude run until it is done with /goal.