Extract shared client DTO validation

[gentamura]

Summary

The CLI currently implements runtime guards (e.g. ) to validate API responses against DTO shapes. Once we add more clients (e.g. web), we should extract these JSON/DTO validators into a shared package (potentially ) instead of inlining them per client.

Context

• DTO types live in
• Runtime validation lives inside the CLI today
• A shared package would prevent duplication when new clients arrive

[gentamura]

Note: we should revisit the naming (e.g., DTO vs Response/Client naming) when extracting the shared validation package.