fix(api): add Zod bounds on financial fields, type vacation router, type scenarioData

- dailyCostCents, hoursPerDay, percentage now validated at API boundary
- vacation router no longer uses ctx.db as any
- scenarioData reads through typed Zod schema

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

packages/api/src/lib/vacation-conflicts.ts

@@ -1,7 +1,7 @@
 import { VacationStatus } from "@capakraken/db";
 import { createNotification } from "./create-notification.js";
 
-type DbClient = {
+export type DbClient = {
   vacation: {
     findUnique: (args: {
       where: { id: string };