Stop throwing for not-found; add Guard and request validation

Not-found lookups return null/false instead of throwing NotFoundException
across all services — a missing row is expected control flow, not an
exceptional condition. NotFoundException stays for embedded precondition
checks inside mutations (missing parent, invalid foreign reference).

Guard (copied from mic-check) enforces required arguments at the top of
every service method. A ported IModelValidator<T> framework validates
every request DTO at the API layer via a new ValidationEndpointFilter,
returning a 400 with field-level messages; services re-run the same
validator and throw for direct callers that bypass the API.

Endpoints translate null/false into 404 via a new ToApiResult() helper.
The agent toolset boundary translates the same nullable/bool results
into the tool-error text the model already expected.

src/Novelly.Api/Scenes/SceneDtos.cs

@@ -1,4 +1,5 @@
 using Novelly.Api.Common;
+using Novelly.Api.Common.Validation;
 
 namespace Novelly.Api.Scenes;
 
@@ -31,6 +32,23 @@ public record CreateSceneRequest(
     string? Prose = null,
     DraftStatus Status = DraftStatus.Planned);
 
+public class CreateSceneRequestValidator : IModelValidator<CreateSceneRequest>
+{
+    public ValidationResult Validate(CreateSceneRequest model)
+    {
+        var result = new ValidationResult();
+
+        if (string.IsNullOrWhiteSpace(model.Title))
+            result.AddError("Title", "'Title' must not be empty.");
+        else if (model.Title.Length > 200)
+            result.AddError("Title", "'Title' must be 200 characters or fewer.");
+
+        SceneValidation.OptionalFields(model.SortOrder, model.Summary, model.Goal, model.Conflict, model.Outcome, model.Location, model.Prose, result);
+
+        return result;
+    }
+}
+
 public record UpdateSceneRequest(
     string? Title = null,
     int? SortOrder = null,
@@ -43,6 +61,54 @@ public record UpdateSceneRequest(
     string? Prose = null,
     DraftStatus? Status = null);
 
+public class UpdateSceneRequestValidator : IModelValidator<UpdateSceneRequest>
+{
+    public ValidationResult Validate(UpdateSceneRequest model)
+    {
+        var result = new ValidationResult();
+
+        if (model.Title is not null)
+        {
+            if (model.Title.Length == 0)
+                result.AddError("Title", "'Title' can not be cleared — a scene always needs one.");
+            else if (model.Title.Length > 200)
+                result.AddError("Title", "'Title' must be 200 characters or fewer.");
+        }
+
+        SceneValidation.OptionalFields(model.SortOrder, model.Summary, model.Goal, model.Conflict, model.Outcome, model.Location, model.Prose, result);
+
+        return result;
+    }
+}
+
+file static class SceneValidation
+{
+    public static void OptionalFields(
+        int? sortOrder, string? summary, string? goal, string? conflict, string? outcome, string? location, string? prose, ValidationResult result)
+    {
+        if (sortOrder is < 0)
+            result.AddError("SortOrder", "'Sort Order' must be zero or greater.");
+
+        if (summary is { Length: > 20000 })
+            result.AddError("Summary", "'Summary' must be 20,000 characters or fewer.");
+
+        if (goal is { Length: > 20000 })
+            result.AddError("Goal", "'Goal' must be 20,000 characters or fewer.");
+
+        if (conflict is { Length: > 20000 })
+            result.AddError("Conflict", "'Conflict' must be 20,000 characters or fewer.");
+
+        if (outcome is { Length: > 20000 })
+            result.AddError("Outcome", "'Outcome' must be 20,000 characters or fewer.");
+
+        if (location is { Length: > 500 })
+            result.AddError("Location", "'Location' must be 500 characters or fewer.");
+
+        if (prose is { Length: > 100000 })
+            result.AddError("Prose", "'Prose' must be 100,000 characters or fewer.");
+    }
+}
+
 public static class SceneMapping
 {
     public static SceneDto ToDto(this Scene s) => new(