Add go-playground/validator + consolidate scattered post-decode checks

[krisarmstrong]

Part of #267 — Phase 2.

Goal

Add github.com/go-playground/validator/v10 and consolidate scattered post-decode checks into declarative validate: tags.

Current state

decodeJSONStrict() is good. But after decode, each handler has inline checks: if testType == "" { testType = "throughput" }, interface existence checks, mode-switch preconditions. These are inconsistent and produce inconsistent error responses.

Acceptance criteria

• github.com/go-playground/validator/v10 added to go.mod (pin exact version)
• Singleton validator in internal/api/validator.go
• validate: tags on DTOs in: handlers_auth.go, handlers_license.go, handlers_recovery.go, handlers_settings.go, handlers_mode.go
• Helper validateStruct(w, v) bool writes 400 with structured field errors
• Inline checks replaced where they map cleanly to validator rules; complex cross-field rules use StructLevelFunc
• Defaults (testType = "throughput") moved out of validation into an explicit default-fill step (don't conflate "valid" with "defaulted")
• At least 3 DTOs covered by unit tests
• No //nolint suppression

Notes

Coordinate the error response shape with seed's parallel validator work (krisarmstrong/seed) so the two repos return the same JSON error envelope.