feat(#295): validate FederationCapabilities structure

Add DTO validation for FederationCapabilities to ensure proper structure.
- Create FederationCapabilitiesDto with class-validator decorators
- Validate boolean types for capability flags
- Validate string type for protocolVersion
- Update IncomingConnectionRequestDto to use validated DTO
- Add comprehensive unit tests for DTO validation

Fixes #295

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/federation/dto/connection.dto.ts

@@ -4,8 +4,10 @@
  * Data Transfer Objects for federation connection API.
  */
 
-import { IsString, IsUrl, IsOptional, IsObject, IsNumber } from "class-validator";
+import { IsString, IsUrl, IsOptional, IsObject, IsNumber, ValidateNested } from "class-validator";
+import { Type } from "class-transformer";
 import { Sanitize, SanitizeObject } from "../../common/decorators/sanitize.decorator";
+import { FederationCapabilitiesDto } from "./capabilities.dto";
 
 /**
  * DTO for initiating a connection
@@ -57,8 +59,9 @@ export class IncomingConnectionRequestDto {
   @IsString()
   publicKey!: string;
 
-  @IsObject()
-  capabilities!: Record<string, unknown>;
+  @ValidateNested()
+  @Type(() => FederationCapabilitiesDto)
+  capabilities!: FederationCapabilitiesDto;
 
   @IsNumber()
   timestamp!: number;