🟢 Low: Input Validation, Resiliency, and Duplication

### Medium-priority improvements for resilience, correctness, and maintainability.

#### 1. Input validation for APIs
- Controller methods accept strings (e.g., `agentIdentityName`, `agentUserIdentityUpn`) with little/no format or length checks.
- RECOMMENDATION: Add `[Required]`, `[StringLength]`, `[EmailAddress]`, and custom format checks for parameters.

#### 3. Minor logic/code duplication
- Multiple controllers/services duplicate string handling or validation patterns (e.g., extracting local-part from UPN via substring).
- RECOMMENDATION: Extract as helper methods/shared library.

#### 4. PowerShell: Hardcoded sleep delays
- `Start-Sleep` delays of "2/3 seconds" are used awaiting replication; could be too short/long, non-deterministic.
- RECOMMENDATION: Refactor to polling functions/loop with max attempts for actual resource readiness.

__Severity: low__

No files or tests are named. Start by locating the controller methods, duplicated UPN string handling, and PowerShell Start-Sleep calls described in the issue; done means validated inputs, shared handling where appropriate, and readiness polling with bounded attempts.

Written by the indexing model from the issue text.