feat: validate admin and time-blocker request structs

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/scheduling/time-blockers.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"crussell/db"
+	"crussell/internal/validators"
 	"crussell/mw"
 
 	"github.com/go-chi/chi/v5"
@@ -29,10 +30,10 @@ type TimeBlocker struct {
 }
 
 type CreateTimeBlockerRequest struct {
-	StartTime       time.Time `json:"start_time"`
-	DurationMinutes int       `json:"duration_minutes"`
-	Description     string    `json:"description,omitempty"`
-	CronExpression  *string   `json:"cron_expression,omitempty"`
+	StartTime       time.Time `json:"start_time" validate:"required"`
+	DurationMinutes int       `json:"duration_minutes" validate:"required,gt=0"`
+	Description     string    `json:"description,omitempty" validate:"omitempty,max=500"`
+	CronExpression  *string   `json:"cron_expression,omitempty" validate:"omitempty,max=500"`
 }
 
 // --- List Time Blockers ---
@@ -123,6 +124,11 @@ func CreateTimeBlocker(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	if err := validators.Validate.Struct(&req); err != nil {
+		http.Error(w, err.Error(), http.StatusBadRequest)
+		return
+	}
+
 	// Validate required fields
 	if req.StartTime.IsZero() {
 		http.Error(w, "start_time is required", http.StatusBadRequest)