[Security/Bug] Missing server-side validation on petition creation endpoint (POST /api/petitions)

## Description

The backend API for petition creation (POST `/api/petitions`) lacks server-side validation. While the frontend enforces rules like minimum character counts for `titles` and `descriptions`, these checks are easily bypassed by intercepting and modifying the request (e.g., via curl). This allows the creation of petitions with invalid or malicious data, such as a single-character `description`, which violates the platform's data integrity.

## Steps to reproduce

1. Log in to the application and navigate to the Create Petition page.
2. Fill out the form with valid data and open the browser's Developer Tools.
3. Go to the Network tab and submit the form.
4. Locate the `POST /api/petitions` request, right-click it, and select Copy as `cURL`.
5. Paste the command into a terminal and modify the payload.
6. Execute the modified curl command.
7. Observe that the server returns a `200 OK` and saves the invalid petition to the database.

## Expected behavior
The server should validate all incoming data against a strict schema. If any field fails validation (e.g., title too short, missing description, invalid
target count), the API should return a `400 Bad Request` status code (or 422) with a clear error message indicating which fields failed.

## Actual behavior
The backend accepts any payload from an authenticated user and creates the petition record regardless of the content's validity.

## Environment Details

| Component | Specification |
| :--- | :--- |
| **OS** | Windows 11 (WSL2) |
| **Runtime** | Cloudflare Pages (`workerd`) |
| **Database** | D1 (SQLite Emulation) |
| **Wrangler** | `v4.40.0` |
| **Endpoint** | `POST /api/petitions` |

## Screenshots or logs

### FE Validation: Client-Side Form Validation

### BE Validation: Server-Side Response (Missing Validation Check)

Start at the POST /api/petitions handler and compare its accepted request data with the validation rules used by the Create Petition form. Add server-side rejection for invalid fields with a clear 400 or 422 response, then verify that malformed curl payloads are not saved while valid petitions still succeed.

Written by the indexing model from the issue text.