Server-side API validation

[eartharoid]

Client-side validation is fine for private bots but server-side validation is needed for two reasons:

• lack of validation can be abused to create a lot of errors on the public bot
• HTML/browser validation doesn't work on the questions & options inputs as hidden form inputs are not validated, meaning you can accidentally submit the form with empty required fields

Use joi schemas.

[eartharoid]

Also improve client-side validation (especially for questions), perhaps with https://developer.mozilla.org/en-US/docs/Web/HTML/Constraint_validation (https://www.freecodecamp.org/news/form-validation-with-html5-and-javascript/).