fix(auth,services,profile): add request struct validation

Add validate tags and validators.Validate.Struct() calls on request structs for auth verification, service creation, and user patch test endpoints.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/auth/local.go

@@ -407,11 +407,11 @@ func RefreshTokenHandler(w http.ResponseWriter, r *http.Request) {
 }
 
 type VerificationCodeRequest struct {
-	Email string `json:"email"`
+	Email string `json:"email" validate:"required,email,max=254"`
 }
 
 type VerifyCodeRequest struct {
-	Code string `json:"code"`
+	Code string `json:"code" validate:"required,max=64"`
 }
 
 type VerificationResponse struct {
@@ -425,6 +425,10 @@ func GenerateVerificationCodeHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	email := strings.TrimSpace(strings.ToLower(req.Email))
 	if email == "" {
@@ -472,6 +476,10 @@ func VerifyCodeHandler(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, "invalid request", http.StatusBadRequest)
 		return
 	}
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
 
 	code := strings.TrimSpace(req.Code)
 	if code == "" {