fix: add Zod validation for payment endpoint

[biocai]

Summary

• Add Zod schema validation for payment request body before passing to payment service
• Prevents invalid or missing fields (e.g. negative amount, invalid currency) from reaching the service layer

Changes

• New file apps/api/src/validators/payment.js with createPaymentSchema (amount: positive number, currency: 3-char string, defaults to "usd")
• Updated apps/api/src/controllers/paymentController.js to parse request body with the schema

Testing

• Validates amount is a positive number
• Validates currency is a 3-character string (ISO 4217), defaults to "usd"
• Returns 400 with Zod error details on invalid input

Fixes #3358