Validate target manager request bodies

[adamtheturtle]

Validate target-manager control payloads as precise Pydantic models or TypedDict adapters before constructing domain objects. OAuth credentials, image targets, partial target updates, and recognition counts now have known types, removing 22 Pyrefly suppressions at once.

Validation:

• uv run pytest -q tests/mock_vws/test_flask_app_usage.py (48 passed)
• uv run prek run --all-files
• uv run prek run --all-files --hook-stage pre-push
• uv run prek run --all-files --hook-stage manual

[adamtheturtle]

Consolidated into #3590 so this cleanup is represented by one PR for the project.