fix(auth,services,profile): add request struct validation

Add validate tags and validators.Validate.Struct() calls on request structs for auth verification, service creation, and user patch test endpoints.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/auth/local.go

@@ -407,11 +407,11 @@ func RefreshTokenHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 type VerificationCodeRequest struct {
-	Email string `json:"email"`
+	Email string `json:"email" validate:"required,email,max=254"`
 }
 
 type VerifyCodeRequest struct {
-	Code string `json:"code"`
+	Code string `json:"code" validate:"required,max=64"`
 }
 
 type VerificationResponse struct {
@@ -425,6 +425,10 @@ func GenerateVerificationCodeHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	email := strings.TrimSpace(strings.ToLower(req.Email))
 	if email == "" {
@@ -472,6 +476,10 @@ func VerifyCodeHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	code := strings.TrimSpace(req.Code)
 	if code == "" {

backend/handlers/services/services.go

@@ -88,6 +88,10 @@ func CreateServiceHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "Invalid JSON: "+err.Error(), http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	// Basic validation
 	if req.Name == "" {

backend/handlers/user/profile.go

@@ -657,7 +657,7 @@ func GetEligiblePatchTestServicesHandler(w http.ResponseWriter, r *http.Request)
 }
 
 type AddPatchTestRequest struct {
-	PatchTestID string `json:"patch_test_id"`
+	PatchTestID string `json:"patch_test_id" validate:"required"`
 }
 
 // POST /api/admin/users/{id}/patch-tests
@@ -674,6 +674,10 @@ func AddPatchTestHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	if req.PatchTestID == "" {
 		http.Error(w, "patch_test_id is required", http.StatusBadRequest)