test: ✅ fuzz the API with fast-check + supertest

[hermannleboss]

Description

Is your feature request related to a problem?
Backend tests hit fixed payloads. The highest-value API bug is the input that slips past zod
validation and crashes a handler — an uncontrolled 500 instead of a controlled 4xx.
Example-based tests don't explore that input space.

Describe the solution you'd like
Add fast-check to backend/ and fuzz routes through supertest against the in-process Express
app, reusing the vi.hoisted Prisma-mock pattern from authController.test.ts. Core invariants:

• bad/random input -> a controlled 4xx, never a 5xx;
• a protected route -> 401 when the token is absent/malformed, whatever the body;
• the response body is always valid JSON and never leaks a stack trace;
• if a zod schema accepts an input, the handler must not crash on that same input.

Also fuzz the zod schemas directly (src/validation/schemas/*): safeParse(anything) never
throws (only returns { success: false }), .transform() steps are idempotent, numeric bounds
hold at the edges (0, negatives, floats, MAX_SAFE_INTEGER + 1, "1e999").

Alternatives considered
zod-fast-check targets zod v3; we are on v4, so arbitraries are hand-written or derived from
fc.anything().

Acceptance Criteria

• fast-check added as a dev dependency in backend/.
• An endpoint fuzz test covering the "no uncontrolled 5xx" + "auth always enforced" invariants on at least one protected route.
• At least one zod schema fuzzed for the "never throws / bounds hold" properties.
• Runs under backend/'s test command and in CI.