[SECURITY] E1-7: hookBodySchema uses .passthrough() — forward unknown fields

[OneStepAt4time]

Finding

ID: SD-VAL-03 | Severity: 🟠 MEDIUM

hookBodySchema uses .passthrough(). Unknown fields in hook payloads are silently retained and forwarded to SSE subscribers and the event bus.

Fix Required

Remove .passthrough() and use .strict() or enumerate permitted extra fields explicitly.

Files: src/validation.ts

Acceptance Criteria

A hook payload with unknown field x_evil: 1 is stripped before SSE delivery.

Milestone

M-E1: Security Hardening