fix: align app manifest validation with CAMARA

Validate POST /apps against a CAMARA-aligned app manifest model, require UUID appId and requiredResources, keep optional fields optional, and accept CAMARA-style repository URIs without over-constraining appRepo metadata.