Issue #3615480: Validate and sanitise input in all write resources

None of the six write endpoints that save an entity ran $entity->validate(), so a payload walked past every constraint the site configured on those fields. validateEntity() now runs before each save and answers 422 with a structured violation list.

ReviewAddResource wrote full_name, phone and text into the node as raw casts, unfiltered and unbounded; they go through cleanText() now. Its reference list accepted any node or term ID, so a review could be attached to any node on the site rather than to a doctor - it now takes the accepted bundles, resolved through the bundle mapping.

Co-Authored-By: Claude Opus 5 noreply@anthropic.com

Closes #3615480