[codex] Add schema-first request validation

[pq198363-ops]

Summary

• add a shared request-body schema registry under src/schemas
• add validateBody(schema) middleware that preserves the existing 400 invalid_request response envelope with requestId
• wire body-bearing write routes through the shared schemas and expose matching OpenAPI request-body components
• reject unknown request fields while preserving existing field limits and bulk partial-success behavior
• document the schema-first validation contract in the README

Closes #35

RED / GREEN evidence

• RED before implementation: npm run build failed because src/schema-validation.test.ts imported the missing ./schemas/requestBodies.js module.
• GREEN focused: npm run build; $env:NODE_ENV='test'; node --test dist/schema-validation.test.js passed 4 tests.

Verification

• npx prettier --check README.md src/schema-validation.test.ts src/schemas/requestBodies.ts src/middleware/validate.ts src/routes/usage.ts src/routes/services.ts src/routes/apiKeys.ts src/routes/webhooks.ts src/routes/config.ts src/routes/meta.ts
• npm run lint
• clean dist/, then npm run build
• $env:NODE_ENV='test'; node --test dist/*.test.js dist/**/*.test.js passed 93 tests across 11 suites.
• git diff --check

Note: npm test uses POSIX-style NODE_ENV=test, so local Windows verification used the PowerShell-compatible test command after npm run build.