main
fix: open redirect vulnerability, standardize remaining API error handling
refactor: replace manual request.json() + validateBody with parseAndValidate in 22 API routes