feat(#295): validate FederationCapabilities structure

Add DTO validation for FederationCapabilities to ensure proper structure.
- Create FederationCapabilitiesDto with class-validator decorators
- Validate boolean types for capability flags
- Validate string type for protocolVersion
- Update IncomingConnectionRequestDto to use validated DTO
- Add comprehensive unit tests for DTO validation

Fixes #295

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

apps/api/src/federation/federation.controller.spec.ts

@@ -339,5 +339,30 @@ describe("FederationController", () => {
       });
       expect(connectionService.handleIncomingConnectionRequest).toHaveBeenCalled();
     });
+
+    it("should validate capabilities structure with valid data", async () => {
+      const dto = {
+        instanceId: "remote-instance-456",
+        instanceUrl: "https://remote.example.com",
+        publicKey: "PUBLIC_KEY",
+        capabilities: {
+          supportsQuery: true,
+          supportsCommand: false,
+          supportsEvent: true,
+          supportsAgentSpawn: false,
+          protocolVersion: "1.0",
+        },
+        timestamp: Date.now(),
+        signature: "valid-signature",
+      };
+      vi.spyOn(connectionService, "handleIncomingConnectionRequest").mockResolvedValue(
+        mockConnection
+      );
+
+      const result = await controller.handleIncomingConnection(dto);
+
+      expect(result.status).toBe("pending");
+      expect(connectionService.handleIncomingConnectionRequest).toHaveBeenCalled();
+    });
   });
 });