fix(security): Register a global ValidationPipe

No global `ValidationPipe` is registered (missing in main.ts, no `APP_PIPE`). Only 4 controllers validate input via `@UsePipes` (`meetings`, `tasks`, `subtasks`, `tags`). The other 10 - `auth`, `users`, `api-keys`, `communities`, `clubs`, `activity-feed`, `notifications`, `notification-preferences`, `moderation`, `gamification` - accept unvalidated bodies (no `whitelist`, DTO decorators ignored).

**To do**
- Register `app.useGlobalPipes(new ValidationPipe({ whitelist: true, transform: true }))` in main.ts.
- Remove now-redundant per-controller `@UsePipes`.

Start in main.ts, then inspect the listed controllers and their existing @UsePipes declarations. Register the global ValidationPipe with whitelist and transform, remove redundant per-controller pipes, and verify that all listed controllers validate and transform request bodies consistently.

Written by the indexing model from the issue text.