Merge remote-tracking branch 'origin/dev' into agent/dex/CUB-32-usage-logging-service

# Conflicts:
#	backend/Infrastructure/Data/ExtrudexDbContext.cs
#	backend/Infrastructure/Data/Migrations/ExtrudexDbContextModelSnapshot.cs

backend/Program.cs

@@ -1,4 +1,5 @@
 using System.Reflection;
+using Extrudex.API.Filters;
 using Extrudex.API.Hubs;
 using Extrudex.Domain.Interfaces;
 using Extrudex.Infrastructure.Data;
@@ -23,7 +24,10 @@ builder.Services.AddDbContext<ExtrudexDbContext>(options =>
     options.UseNpgsql(connectionString));
 
 // ── API Services ───────────────────────────────────────────
-builder.Services.AddControllers();
+builder.Services.AddControllers(options =>
+{
+    options.Filters.AddService<FluentValidationFilter>();
+});
 builder.Services.AddEndpointsApiExplorer();
 builder.Services.AddSwaggerGen(c =>
 {
@@ -53,6 +57,10 @@ builder.Services.AddScoped<IUsageLogService, UsageLogService>();
 // Registers all validators from the API assembly into DI.
 builder.Services.AddValidatorsFromAssembly(Assembly.GetExecutingAssembly());
 
+// Register the FluentValidation action filter so validators run automatically
+// on all API controller actions before the action executes.
+builder.Services.AddScoped<FluentValidationFilter>();
+
 // ── CORS (kiosk + remote browser) ─────────────────────────
 // AllowAnyOrigin disallows credentials by spec; this is fine for
 // REST API calls. SignalR WebSockets negotiate without credentials