📝 docs: restore ADR-0011 validation library selection

- Restored ADR-0011 with updated implementation details
- Documented go-playground/validator adoption and integration strategy
- Added technical implementation examples and migration path
- Updated status to 'Adopted' reflecting current usage

🔧 refactor: integrate authentication handlers with validation system

- Added validation tags to all authentication request DTOs:
  - LoginRequest: username (3-50 chars), password (6+ chars)
  - RegisterRequest: username (3-50 chars), password (6-100 chars)
  - PasswordResetRequest: username (3-50 chars)
  - PasswordResetCompleteRequest: username (3-50 chars), new_password (6-100 chars)
- Updated AuthHandler to accept validator parameter
- Replaced manual validation with structured validator.Validate() calls
- Added writeValidationError() helper for consistent error responses
- Updated server to inject validator into authentication handler
- Improved error messages with field-level validation details

🧪 test: update BDD tests for new validation error format

- Updated authentication validation tests to expect structured errors
- All 25 BDD scenarios passing with improved validation coverage
- Maintained backward compatibility for error handling

Generated by Mistral Vibe.
Co-Authored-By: Mistral Vibe <vibe@mistral.ai>

pkg/bdd/steps/steps.go

@@ -401,10 +401,10 @@ func (sc *StepContext) theAuthenticationShouldFailWithValidationError() error {
 		return fmt.Errorf("expected status 400, got %d", sc.client.GetLastStatusCode())
 	}
 
-	// Check if response contains validation error
+	// Check if response contains validation error (new structured format)
 	body := string(sc.client.GetLastBody())
-	if !strings.Contains(body, "invalid_request") {
-		return fmt.Errorf("expected response to contain invalid_request error, got %s", body)
+	if !strings.Contains(body, "validation_failed") && !strings.Contains(body, "invalid_request") {
+		return fmt.Errorf("expected response to contain validation_failed or invalid_request error, got %s", body)
 	}
 
 	return nil