feat: add Zod validation schemas for all domain routes

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/admin/company-settings.ts

@@ -4,6 +4,8 @@ import { requireAuth, requirePermission } from '../../middleware/auth';
 import { logAudit } from '../../services/audit';
 import { success, error } from '../../utils/response';
 import multipart from '@fastify/multipart';
+import { parseBody } from '../../schemas/common';
+import { UpdateCompanySettingsSchema } from '../../schemas/company-settings.schema';
 
 /** Encode custom_fields + supplier_field_order into a single JSON blob (matching PHP format) */
 function encodeCustomFields(fields: unknown, fieldOrder: unknown): string | null {
@@ -142,7 +144,9 @@ export default async function companySettingsRoutes(fastify: FastifyInstance): P
   });
 
   fastify.put('/', { preHandler: requirePermission('offers.settings') }, async (request, reply) => {
-    const body = request.body as Record<string, unknown>;
+    const parsed = parseBody(UpdateCompanySettingsSchema, request.body);
+    if ('error' in parsed) return error(reply, parsed.error, 400);
+    const body = parsed.data;
 
     const existing = await prisma.company_settings.findFirst();
     if (!existing) return error(reply, 'Nastavení nenalezeno', 404);