Add validator crate for HTTP request validation

[icook]

Summary

• Adds validator crate (v0.20) for declarative request validation
• Creates validation module with custom validators
• Refactors SignupRequest as proof of concept

Before

// Manual validation with repetitive boilerplate
let username = req.username.trim();
if username.is_empty() {
    return (StatusCode::BAD_REQUEST, Json(ErrorResponse { ... }));
}
if username.len() > 64 {
    return (StatusCode::BAD_REQUEST, Json(ErrorResponse { ... }));
}

After

#[derive(Validate)]
struct SignupRequest {
    #[validate(length(min = 1, max = 64, message = "Username must be 1-64 characters"))]
    username: String,

    #[validate(custom(function = "validate_base64url_ed25519_pubkey"))]
    root_pubkey: String,
}

Test plan

• Backend tests pass
• Backend linting passes
• CI passes

Closes #153

🤖 Generated with Claude Code