feat(signaling): input validation hardening on all gRPC endpoints

[courtnaejames1]

Overview

Adds a dedicated validate.go file to the signaling package that centralises all input validation logic. Inline checks scattered across grpc.go are replaced with single validator calls at the top of each handler. Validation rules are now enforced consistently on every inbound RPC call, including those made directly via grpcurl or the Go test client, not just through the Qt UI.

Changes

New file — backend/internal/signaling/validate.go

• Package-level constants: maxUserIDLength = 64, maxCamerasAllowed = 4
• Compiled regex: ^ROOM-\d{6}$ — initialised once at package load
• Shared helpers: validateRoomCode, validateUserID
• Per-RPC validators: validateJoinRequest, validateCreateSessionRequest, validateCloseSessionRequest, validateGetMySessionsRequest

New file — backend/internal/signaling/validate_test.go

• 30+ table-driven unit tests covering every validator
• Tests cases include: valid input, empty fields, malformed room codes, oversized user IDs, invalid roles, and out-of-range camera counts
• No server or Redis instance required — pure function tests

Modified — backend/internal/signaling/grpc.go

• Scattered inline validation blocks removed from all four handlers
• Each handler now opens with a single if err := validateXRequest(req); err != nil call
• No business logic changes

Modified — backend/internal/signaling/grpc_test.go

• Hardcoded room codes updated from ROOM-TEST to ROOM-123456 to satisfy the new regex

Rules enforced

• Room code: ROOM-\d{6}
• User ID length: 1 – 64 chars
• Max cameras: 1 – 4
• Role: camera | director

Testing

All existing tests pass.
Run: cd backend && make test-intergration

Closes #210