Validates a query builder payload against the organization's data. Note the convention: a validation failure is reported with HTTP 200 and a non-zero "error" field in the body, not with a 4xx status. Test the body, not the status code. This is unchanged by decision -- existing callers depend on it. A 4xx here means the request itself was rejected (bad JSON, or no permission), not that the query is invalid.