feat: integrate Zod schemas for opt-in runtime validation

[benminer]

Wires the auto-generated Zod schemas (from #124) into the SDK's resource layer for runtime validation.

Usage

Validation is enabled by default. No config changes needed — all SDK methods that have matching schemas will validate inputs and responses automatically.

// Validation is on by default
const client = new Scope3Client({ apiKey: 'sk_xxx', persona: 'buyer' });

// Opt out if needed
const client = new Scope3Client({
  apiKey: 'sk_xxx',
  persona: 'buyer',
  validate: false,        // disable all validation
  // validate: 'input'    // validate request bodies only
  // validate: 'response' // validate API responses only
});

When enabled, invalid inputs throw Scope3ApiError(400) and unexpected API response shapes throw Scope3ApiError(502) with structured Zod validation details.

Changes

• src/validation.ts — Validation utility (validateInput, validateResponse, mode helpers)
• src/schemas/registry.ts — Hand-maintained mapping from resource operations to auto-generated Zod schemas
• src/types/index.ts — Add validate option to Scope3ClientConfig
• src/adapters/base.ts — Add validate to BaseAdapter interface
• src/adapters/rest.ts, src/adapters/mcp.ts — Thread validate config through adapters (default: true)
• Resource files — Wire validation into campaigns, reporting, sales-agents, and products; validated data is used (not discarded) so Zod defaults/transforms apply
• Tests — 14 new validation tests, all 239 tests pass

Design Decisions

• Validation on by default — schemas are generated from the OpenAPI spec and represent the correct API contract. Consumers who hit issues can opt out.
• Validate at the resource layer, not the adapter — each method knows its schemas
• Keep hand-written types as the public API surface; schemas are runtime guards only
• Schema registry bridges auto-generated schemas to SDK methods without modifying generated code
• Validated data is used — return values from validateInput/validateResponse are sent to the API / returned to consumers, so Zod defaults and transforms are applied
• Bundles resource has no validation yet — schemas have diverged significantly from SDK types (advertiserId: number vs string, discoveryId vs bundleId)

[nastassiafulconis]

nice!