Gap 18: Validate POST /v1/reservations. Scope enforcement handled upstream by EnforceApiScope middleware.