Package validation defines the validation contract.
There is no reflection and there are no struct tags: every request type
implements Validate and returns the errors per field. It is more verbose than
`binding:"required"`, and deliberately so -- the message is written by whoever
knows the domain, and the CLI generates the method skeleton along with the
struct.
Email checks the shape only. Deliverability is proven by sending mail, never
by a regular expression.
Whitespace is rejected rather than trimmed: an address with a space in it is
almost always a paste accident, and silently trimming input hides the mistake
from the person who made it.