feat(server): adopt nestjs-zod with a fail-closed body-contract boot gate

- One global ZodValidationPipe (APP_PIPE, createZodValidationPipe) validates
  any @Body() typed with a createZodDto class; the custom exception factory
  keeps TREK's { error: 'field: message; ...' } envelope byte-identical.
- The 7 piped controllers (collections, places, vacay, todo, health,
  airtrail x2) now type bodies with colocated <domain>.dto.ts wrappers —
  the Zod schemas in @trek/shared stay the single source of truth.
- OpenAPI: the hand-rolled api-zod.ts enricher is replaced by nestjs-zod's
  cleanupOpenApiDoc; request bodies surface as $refs to named DTO schemas.
- validateBodyContracts() runs in buildApp() after init and refuses to boot
  when any POST/PUT/PATCH @Body() (including @Body('field') sub-reads) lacks
  a ZodDto metatype. The 175 pre-existing legacy handlers are grandfathered
  in body-contract-allow-list.ts; the list is ratchet-only — the gate also
  throws on stale entries, so migrating a domain forces their removal.

server/package.json

@@ -44,6 +44,7 @@
     "jimp": "^1.6.1",
     "json5": "^2.2.3",
     "jsonwebtoken": "^9.0.2",
+    "nestjs-zod": "^5.5.0",
     "node-cron": "^4.2.1",
     "nodemailer": "^9.0.1",
     "otplib": "^12.0.1",