fix(api): validate request bodies with Zod in 4 routes — restores the t06 gate (#9779)

The release-green verdict (#9737) lists check:route-validation:t06 as a HARD
failure and it is STILL red on the current tip: four routes call
request.json() and hand-roll `typeof x === "string"` checks instead of using
Zod, which Hard Rule #7 requires and the gate enforces (it scans source and
has no allowlist).

- src/app/api/plugins/marketplace/install (#9445): InstallBodySchema; the
  400 'Missing or invalid name field' response is preserved verbatim.
- src/app/api/services/dario/admin/accounts (#8523): DeleteAccountBodySchema
  for the optional { alias } DELETE body; query-param path untouched.
- src/app/api/services/dario/admin/login-start (#8523): LoginStartBodySchema;
  trimming now happens in the schema, so the forward body is unchanged.
- src/app/api/services/dario/admin/import-from-omniroute (#8523):
  ImportBodySchema for connectionId/alias; invalid shapes fall back to the
  same 'connectionId is required' 400 as before.

All four keep their exact status codes and messages — this is a validation
mechanism swap, not a contract change (plugins route suite still 33/33).

Adds tests/unit/route-body-validation-t06.test.ts, which runs the gate's own
rule inside the unit suite so the next such route fails on ITS OWN PR instead
of surfacing weeks later in a base-red sweep. Guard verified by mutation:
renaming .safeParse( in one route makes it fail (1 fail), restored from a
pre-probe copy.

Gates: route-validation:t06, file-size, test-discovery, mutation-test-coverage,
dead-code exit 0; typecheck:core clean; eslint clean.

Refs #9737

Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com>

src/app/api/plugins/marketplace/install/route.ts

@@ -1,9 +1,14 @@
 import { NextRequest, NextResponse } from "next/server";
+import { z } from "zod";
 import { CORS_HEADERS, handleCorsOptions } from "@/shared/utils/cors";
 import { buildErrorBody } from "@omniroute/open-sse/utils/error";
 import { installMarketplacePlugin } from "@/lib/plugins/marketplace";
 import { requireManagementAuth } from "@/lib/api/requireManagementAuth";
 
+const InstallBodySchema = z.object({
+  name: z.string().trim().min(1),
+});
+
 export async function OPTIONS() {
   return handleCorsOptions();
 }
@@ -15,15 +20,14 @@ export async function POST(request: NextRequest) {
   const authError = await requireManagementAuth(request);
   if (authError) return authError;
   try {
-    const body = await request.json();
-    const { name } = body as { name?: string };
-    if (!name || typeof name !== "string") {
+    const parsed = InstallBodySchema.safeParse(await request.json());
+    if (!parsed.success) {
       return NextResponse.json(buildErrorBody(400, "Missing or invalid 'name' field"), {
         status: 400,
         headers: CORS_HEADERS,
       });
     }
-    const result = await installMarketplacePlugin(name);
+    const result = await installMarketplacePlugin(parsed.data.name);
     return NextResponse.json(result, { status: 201, headers: CORS_HEADERS });
   } catch (err: unknown) {
     const msg = err instanceof Error ? err.message : "Failed to install marketplace plugin";