fix: Enforce runtime schema validation for query parameter handlers

Description

Incoming request parameters in endpoint and method handlers should enforce strict primitive type assertions (e.g., string) prior to passing them into backend database query selectors. Passing unvalidated objects or operator keys can cause unexpected query behaviors or runtime type errors.

Steps to Reproduce

1. Supply a non-primitive object payload to an endpoint parameter expecting a primitive type.
2. Observe backend parameter parsing and query formation without schema validation.

Expected Behavior

Request parameters must be strictly validated against runtime schemas (using Zod or check) and reject unexpected input structures with a 400 Bad Request error.

Environment

• Rocket.Chat Version: Latest / Development
• Deployment: Node.js / Docker
• Database: MongoDB

Proposed Solution

Enforce runtime type checks on all controller and service inputs before building database queries:

import { check } from 'meteor/check';

// Enforce string type
check(paramValue, String);

Start by tracing controller and service inputs that feed MongoDB query selectors, then reproduce the non-primitive parameter case described in the issue. Review the existing runtime validation approach using Zod or check and identify the handlers that lack it. Done means unexpected parameter structures are rejected with a 400 Bad Request before query formation.