Validate API request bodies and domain inputs

[DaZuiZui]

Summary

• Require application/json content type and reject trailing JSON values in API request bodies.
• Map duplicate-key and invalid database constraint errors to client-facing 409/400 responses instead of generic 500 responses.
• Add service-layer validation for lifecycle statuses, required time ranges, and non-negative resource/SU amounts.
• Add focused tests and update API documentation to match enforced request-body behavior.

Fixes #478

Tests

go build ./...
go vet ./...
go test ./...