Validate target request bodies at the JSON boundary

[adamtheturtle]

Parse add-target and update-target payloads through strict Pydantic adapters backed by precise TypedDict schemas. Downstream construction now receives known field types, removing 15 Pyrefly unknown-type suppressions and rejecting malformed shapes at the request boundary.\n\nValidation: every pre-commit and pre-push hook applicable to the changed module passes. The public backend tests require live Vuforia credentials locally and remain covered by hosted CI.

[adamtheturtle]

Consolidated into #3590 so this cleanup is represented by one PR for the project.