fix: add Zod validation schema for user creation endpoint

Add createUserSchema with email, name, and role validation
to POST /api/users endpoint to prevent arbitrary data storage.

Fixes #2160

Author: kejuunuy

apps/api/src/controllers/userController.js

@@ -1,10 +1,12 @@
 import { ok } from "../utils/response.js";
 import { createUser, listUsers } from "../services/userService.js";
+import { createUserSchema } from "../validators/user.js";
 
 export async function getUsers(req, res) {
   return ok(res, await listUsers());
 }
 
 export async function postUser(req, res) {
-  return ok(res, await createUser(req.body), 201);
+  const payload = createUserSchema.parse(req.body);
+  return ok(res, await createUser(payload), 201);
 }

apps/api/src/validators/user.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+
+export const createUserSchema = z.object({
+  email: z.string().email(),
+  name: z.string().min(1).max(100),
+  role: z.enum(["client", "freelancer", "admin"]).default("client")
+});
+
+export const updateUserSchema = createUserSchema.partial();