Type Safety: Add Zod runtime validation for external API data

[thesubtleties]

Summary

External data from TMDB API, GitHub cache, and Xtream API is trusted without schema validation.

Current State

• services/tmdb.ts uses as unknown as casts
• services/tmdb-exports.ts trusts GitHub cache structure
• db/sync.ts parses Xtream API responses without validation

Proposed Solution

Add Zod schemas for external data:

import { z } from 'zod';

const TmdbMovieSchema = z.object({
  id: z.number().positive(),
  title: z.string().min(1),
  release_date: z.string().regex(/^\d{4}-\d{2}-\d{2}$/),
  vote_average: z.number().min(0).max(10),
});

Benefits

• Graceful handling of malformed external data
• Clear error messages when APIs change
• Type-safe parsing

Notes

• Adds zod dependency
• Should implement incrementally per integration
• From PR feat(vod): Add Netflix-style Movies & Series pages with TMDB integration #6 review: type-design synthesis