[Viccodes11]

Closes #1684

Summary

Replaces regex-only address validation and loose date/milestone rules on POST /vaults with a schema in apilib/validation.mjs (using zod and @stellar/stellar-sdk) that matches the contract invariants and prevents invalid vaults from being accepted by the API.

Changes

• Address Validation: Enforced StrKey CRC16 checksum verification via StrKey.isValidEd25519PublicKey on creator, verifier, successDestination, and failureDestination. Explicitly rejects muxed M... addresses.
• Destination & Role Constraints: Enforces verifier !== creator and failureDestination !== creator. Invalid optional destinations reject with 400 rather than silently falling back.
• Date Windows: Enforces startDate >= now - 5min (clock skew), endDate > startDate, and endDate - now <= 5 years. Date strings without timezone offsets are treated as UTC.
• Milestone Rules: Enforces non-empty trimmed titles $\le 128$ bytes (UTF-8 byte length), startDate < dueDate <= endDate, and non-decreasing due dates.
• Strict Payload: Rejects unrecognized fields on the payload and milestones.
• Error Format: Returns 400 { error: 'Validation failed', details: [{ field, code, message }] } without echoing raw inputs.
• OpenAPI: Updated apilib/openapi.mjs to reflect constraints and structured error details.
• Tests:
  • Added unit test suite apilib/__tests__/validation.test.mjs covering all positive and negative constraints, including checksum corruption.
  • Added HTTP-level test suite api/__tests__/vaults.create.test.mjs asserting response envelope shape and status codes.