Epic: Boundary validation consolidation

[krisarmstrong]

Goal

Consolidate stem's already-decent boundary validation into a structured layer matching seed + niac.

Context

Stem is in the best shape of the three sibling repos but has gaps. Audited 2026-05-24:

• ✅ decodeJSONStrict() helper in internal/api/server.go (good — used by auth/license/recovery/settings handlers)
• ❌ Post-decode validation is inline per-handler and inconsistent (e.g., testType == "" defaults, interface existence checks)
• ❌ TS side relies on hand-rolled type guards: isStemRole(), isModeUpdateResponse() in ui/src/contexts/RoleContext.tsx
• ❌ SSE consumer has no per-frame validation
• ❌ No schema generation; TS types hand-written and silently drift from Go structs

Children

• Add go-playground/validator + consolidate scattered post-decode checks #268 — Add go-playground/validator/v10 + struct tags; consolidate scattered post-decode checks
• Adopt invopop/jsonschema generator pattern (port from NIAC) #269 — Adopt invopop/jsonschema generator pattern → docs/schemas/*.json
• CI: fail on schema drift between make schema output and committed docs/schemas/ #270 — CI drift check for committed schemas
• Generate TS types from JSON Schemas; retire hand-rolled type guards #271 — Generate TS types from schemas; replace hand-rolled type guards
• Runtime parser (valibot) for SSE consumer + harden RoleContext.tsx #272 — Runtime parser for SSE consumer + harden inline guards in RoleContext.tsx

Phasing

Phase	Children	Goal
2. Go validators	#268	Declarative tags replace inline checks
3. Schema gen pipeline	#269, #270, #271	One source of truth: Go struct → JSON Schema → TS types
4. Trust boundary parsers	#272	Validate SSE frames + outbound API responses

Tech choices

• Go validator: github.com/go-playground/validator/v10
• Schema generator: github.com/invopop/jsonschema (mirrors NIAC's reference impl)
• TS codegen: json-schema-to-typescript
• TS runtime parser: valibot

Cross-repo

• Companion: Epic: Boundary validation hardening (cross-cutting) seed#1099 — primary hardening track
• Reference: krisarmstrong/niac-go#667 — schema generation pattern + ADR