Error handler returns 500 for Zod validation failures instead of 400

Parent Algora bounty: #743

Bug

errorHandler middleware returns 500 Unexpected server error for all unhandled errors, including ZodError thrown by schema.parse(). Controllers such as authController.register, authController.login, and jobController.postJob use schema.parse(req.body) without try/catch, so any Zod validation failure propagates to the error handler and returns 500 instead of 400 Bad Request.

Reproduction

1. Send POST /api/auth/register with body { "email": "notanemail", "password": "short" }.
2. Response: 500 Unexpected server error instead of 400 with a validation message.

Expected behavior

errorHandler must detect ZodError instances and return 400 with the first error message from err.errors, matching the shared { success: false, message } shape.

Scope

Update apps/api/src/middleware/errorHandler.js only. Import ZodError from 'zod' and add a check before the generic 500 handler.

/attempt #743

Start in apps/api/src/middleware/errorHandler.js and reproduce the POST /api/auth/register case described in the issue. Check that Zod validation failures are handled before the generic error path and that the response is 400 with the shared { success: false, message } shape.