Feature/api schema validation joi

[MerlinTheWhiz]

Description

Closes #58

Adds Joi-based request validation to all API route files that accept user input. Every POST/PUT/PATCH handler now validates req.body, and GET handlers validate req.query/req.params, before the controller is called. Invalid requests are rejected with a standardised 400 envelope: { success: false, message: 'Validation failed', errors: [{ source, field, message }] }.

27 route files were either newly validated or extended:

TypeScript routes (8) — schemas added to middleware/validation.ts:

• collaborationRoutes.ts, notificationRoutes.ts, userRoutes.ts, agiTutorRoutes.ts, quizRoutes.ts, holographicRoutes.ts, eventLoggerRoutes.ts, syncRoutes.ts

JavaScript routes (19) — inline Joi schemas with validateRequestSchema:

• admin.js, auth.js, bookmarks.js, offline.js, gamification.js, search.js, courses.js, aco.js, quantumEncryption.js, fraudDetectionRoutes.js, autonomousAgents.js, rbacRoutes.js, content.js, optimization.js, prediction.js, federatedLearning.js, federatedLearningRoutes.js, swarmLearning.js, recommendations.js
• federatedLearning.js, swarmLearning.js, optimization.js and prediction.js were partially updated before this PR; this completes all remaining POST routes in those files.

Pre-validated routes (left as-is — already meet the requirement):

• smartWallet.ts (already used Joi + validateRequestSchema)
• transactions.js, tenantAnalytics.js, tenants.js (already had Joi schemas)
• quantum.js, translation.ts, vrf.ts, timeLockCredentials.ts, crossProtocolBridge.ts, cdnOptimizationRoutes.ts, plagiarismDetectionRoutes.ts, secureCommRoutes.ts (already had express-validator)

Also extended middleware/validation.ts with ~70 new Joi schemas covering collaboration, notifications, user profiles, AGI tutor, quizzes, holographic storage, event logging, sync, admin, announcements, authentication, bookmarks, offline queue, gamification, search, quantum encryption, fraud detection, RBAC, content, courses, ACO, autonomous agents, federated learning, prediction, recommendations, optimisation, and swarm learning domains.

Related Issue

Closes #

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 💥 Breaking change (fix or feature that changes existing behavior)
• 📚 Documentation update
• ♻️ Refactor (no functional change)
• 🧪 Tests
• 🔧 Chore / tooling

Packages Affected

• contracts/ (Soroban / Rust)
• backend/ (Node / Express)
• frontend/ (Next.js)
• docs/

How Has This Been Tested?

• Validation tests (src/__tests__/validation.test.js): 9 unit tests that exercise validateRequestSchema with real Joi schemas — valid body passes through, missing fields return 400 with standard envelope, invalid types return descriptive errors, all three sources (body/query/params) are validated, unknown fields are stripped, and multiple errors per source are aggregated.
• Syntax check: all 19 modified .js files pass node -c.
• TypeScript: tsc --noEmit produces zero errors across the entire backend.
• Pre-existing tests: the global test setup (tests/setup.js) depends on mongodb-memory-server, which crashes with SIGSEGV in this environment — this is a pre-existing infrastructure issue, not caused by these changes. The middleware-specific test suite passes cleanly when the setup file is skipped.

Checklist

• My code follows the project's coding standards (see CONTRIBUTING.md)
• I have run the relevant linters and type checks
• I have added or updated tests that prove my change works
• All new and existing tests pass locally (blocked by pre-existing MongoDB Memory Server issue)
• I have updated documentation where needed
• My commits follow the Conventional Commits format
• I have noted any breaking changes below (or there are none)

Breaking Changes

None

Additional Notes / Screenshots

Design rationale — Joi was chosen over Zod because it is already a dependency ("joi": "^17.9.2" in package.json), the existing validateRequestSchema middleware is built for Joi's .validate() API, and both validation.ts and validation.js already use Joi extensively. Rewriting ~70+ schemas in Zod would have been pure churn with no concrete benefit (the codebase doesn't use Zod's type-inference pattern from schemas).

Error format — all validation errors use the standard envelope:

{
  "success": false,
  "message": "Validation failed",
  "errors": [
    { "source": "body", "field": "email", "message": "\"email\" is required" }
  ]
}

Remaining work — the following routes use express-validator rather than Joi but already validate input: translation.ts, vrf.ts, timeLockCredentials.ts, crossProtocolBridge.ts, cdnOptimizationRoutes.ts, plagiarismDetectionRoutes.ts, secureCommRoutes.ts, quantum.js. They meet the "no raw req.body access" requirement and are safe to leave as-is. Migrating them to Joi would be a future cleanup task.