Properly validate review submissions

The review create/edit endpoints are the most important writes in the app and currently the least validated. The zod schema accepts ratedTracks as an array of anything and album as a record of anything, so a malformed payload sails through validation and blows up somewhere in score calculation or the DB layer instead.

As part of (or right after) the route port:

• Define a real ratedTrackSchema (spotifyID, name, rating 0-10, duration, features, artist IDs) and use it for ratedTracks
• Define a proper schema for the album payload instead of z.record()
• Bad payloads get a 400 with a useful message, and the score calculator can trust its input