[Frontend] Introduce runtime validation for backend responses

## Problem

TypeScript interfaces do not validate untrusted JSON, and malformed nested data has caused renderer crashes.

## Relevant code

`src/lib/api`

## Proposed scope

Add runtime schemas at API boundaries, return typed validation errors, and test missing, extra, and malicious fields.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start by inspecting the API boundary code under src/lib/api and characterize the malformed-response behavior with a focused automated test. Done means runtime validation covers missing, extra, and malicious fields, returns typed validation errors, and includes success, empty/loading where applicable, failure, and boundary-case regression coverage.

Written by the indexing model from the issue text.