Validate request bodies with Zod

[iexwr]

Context

Endpoints accept JSON but do not validate shape, so bad input reaches Prisma/Stellar calls and produces vague 500s.

Acceptance criteria

• Add Zod schemas for webhook payloads and any future write endpoints.
• Invalid input returns 400 with a field-level error message.
• Apply via a small middleware or inline schema.parse.

Technical notes

• Add schemas in src/validate.ts using the existing zod dependency.

Testing

• Test that malformed bodies return 400 with details.