fix(build): use non-destructured require for zod + @strapi/utils

Prevents the same runtime crash that hit magic-link:

  Cannot read properties of undefined (reading 'string')
  at z.string() during plugin load

Pack-up's rollup-commonjs rewrites `const { z } = require('zod')`
into `_interopDefault(...).default.z`. For dual ESM/CJS packages
like zod 3.25+ and @strapi/utils, that `.default` branch does
NOT expose the named members, so `z` resolves to undefined and
every schema build crashes at plugin boot.

Replaced destructured requires with direct property access:
  const { z } = require('zod') → const z = require('zod')
  const { errors: strapiErrors } = require('@strapi/utils')
    → const strapiErrors = require('@strapi/utils').errors

Property access after a plain require() is not touched by rollup-
commonjs, so the runtime value matches source semantics.

Author: Schero94

server/src/validation.js

@@ -1,6 +1,13 @@
 'use strict';
 
-const { z } = require('zod');
+// NOTE: Do not destructure `z` at require-time.
+// @strapi/sdk-plugin's bundler (pack-up → @rollup/plugin-commonjs) rewrites
+// `const { z } = require('zod')` as an ESM-style named import, which resolves
+// to `_interopDefault(require('zod')).default.z` — undefined in zod 3.25+
+// because the dual ESM/CJS `.default` branch does not expose the `z`
+// namespace. Plain `require('zod')` gives the same API via direct property
+// access and sidesteps the rewrite.
+const z = require('zod');
 
 const emailString = z.string().email().max(254);
 const safeString = z.string().max(1000);
@@ -327,7 +334,7 @@ function validate(schemaName, body) {
 
   const result = schema.safeParse(body);
   if (!result.success) {
-    const { errors: strapiErrors } = require('@strapi/utils');
+    const strapiErrors = require('@strapi/utils').errors;
     const flattened = result.error.flatten();
     // eslint-disable-next-line global-require
     const strapiLog = (typeof strapi !== 'undefined' && strapi && strapi.log) ? strapi.log : null;