Add input validation to the custom Territory/Activity Actions

Problem

Claim/conquest/activity-store read raw request.get() with no validations rules (unlike generated CRUD actions), so malformed/missing input isn't rejected consistently.

Acceptance

• Add validations (or explicit guards) for activity_id/user_id/gpx_data etc.
• Consistent 4xx with field errors.

Done in 03f8e2d.

Every hand-written action now validates input before touching the database, with one consistent contract: malformed input → 422 with a field-keyed error map ({ success: false, error: 'Validation failed', fields: { distance: 'required: miles as a number between 0 and 1000' } }); 401/403/404 semantics unchanged.

• Shared validators in resources/functions/validate.ts (positiveInt, boundedNumber, boundedString, durationString), auto-imported like the other resource functions.
• Covered actions: territory claim + process-conquest + decay-sweep, activity store/update/destroy, kudos toggle, comment store, follow toggle, trail review store.
• ids must be positive integers ('abc'/-5/1.5 all rejected), distance/elevation bounded, durations must match MM:SS / H:MM:SS, gpx_data must be a string under 2MB, dates must parse, comment bodies capped at 2000 chars. All violations for a request are reported in a single 422.

Verified by scripts/verify-validation.ts (18 checks) + all 9 other suites green (valid input paths unchanged).