controllers should use bespoke request DTOs instead of the `Request` service

Symfony added this feature a bit ago: https://symfony.com/blog/new-in-symfony-6-3-mapping-request-data-to-typed-objects

the `LogInController` uses it, but few other endpoints do. upgrade all controllers that handle requests to use them.

other notes:
* if you find a controller that really feels like "nah, it should keep using `Request`", add a comment explaining why `Request` is being used instead of a request DTO
* request DTOs must live in the same file as the controller that uses them
* do not fall for the trap of "false sameness" - 99%+ of request DTOs have no business being shared between multiple endpoints

it's totally legit to upgrade just one endpoint or a small group of endpoints in a PR; this issue will be closed when no controllers remain which are using `Request`.

Start by reviewing the controllers that use the Symfony Request service and compare them with LogInController, which already uses request data mapping. Convert endpoints incrementally to request DTOs kept beside their controllers; for any exception, document why Request remains, and finish when no unjustified controller uses Request.

Written by the indexing model from the issue text.