# Issue #217: No Request Validation Layer

## Problem

Input validation is scattered across controllers and services:

1. **Controller level**: Some controllers validate input exists:
   ```php
   $data = $this->getRequestData();
   // Assumes $data is always valid
   ```

2. **Service level**: `MemberService::validateRequiredFields()` checks for required fields:
   ```php
   private function validateRequiredFields(array $data): void {
       $required = ['vorname', 'nachname', 'eintritt'];
       // ...
   }
   ```

3. **No type validation**: Phone numbers are validated via `PhoneValidator::validateAndNormalize()`, but other fields have no type checking.

4. **No schema validation**: There's no declarative validation schema.

## Impact

- Inconsistent validation (some fields validated, others not)
- Potential security issues (SQL injection mitigated by ORM, but XSS, etc. not checked)
- Difficult to know what validation exists for each endpoint
- No auto-generated API documentation from validation schemas

## Solution

Implement a validation layer using Symfony Validator or similar:

```php
class CreateMemberRequest {
    #[Assert\NotBlank]
    #[Assert\Length(min: 1, max: 100)]
    public string $vorname;
    
    #[Assert\NotBlank]
    #[Assert\Length(min: 1, max: 100)]
    public string $nachname;
    
    #[Assert\NotBlank]
    #[Assert\Date]
    public string $eintritt;
    
    #[Assert\Date]
    public ?string $geburtsdatum = null;
    
    #[Assert\Choice(['maennlich', 'weiblich', 'divers'])]
    public ?string $geschlecht = null;
}

public function create(): JSONResponse {
    $data = $this->getRequestData();
    $violations = $this->validator->validate($data, CreateMemberRequest::class);
    if (count($violations) > 0) {
        return $this->validationError($violations);
    }
    // ...
}
```

## Tasks

- [ ] Add Symfony Validator dependency
- [ ] Create validation DTOs for each endpoint
- [ ] Add Assert annotations for all fields
- [ ] Implement validation middleware or base controller method
- [ ] Return structured validation errors (field → message)
- [ ] Update services to remove inline validation (keep business logic only)
- [ ] Add tests for validation rules

## Labels

- enhancement
- security
- backend
- priority:medium