Support validating route params in request validators

[imdhemy]

Summary

Add first-class validation for route/path params alongside request body validation.

Context

This came from openkairos/kairos PR #147: openkairos/kairos#147 (comment)

Kairos has a route like:

POST /api/v1/workspaces/:workspaceId/sources

The application needs to validate workspaceId before it is converted to a MongoDB ObjectId. Without route-param validation support, invalid params can reach infrastructure and surface as a 500 instead of a client error.

Desired behavior

• Request validation can target path params, not only the request body.
• Param validation failures return the same 400 response shape as body validation failures.
• Handlers can rely on validated route params before adapting them into application commands.

Example

Conceptually, application code should be able to declare validation rules for params such as:

params: {
  workspaceId: ['objectId']
}

👉 The exact API shape can differ, but route params should be supported as first-class request input.