> Is it input validation to say a string must be at least some length characters

Yes. Yes it is. Input validation should happen at the public API and then contracts after that.

Contracts are very explicitly for things you don't want to ever see happen. They are "something went wrong".

So your API would accept a function that handles input validation and maybe has its own contract for things it explicitly doesn't handle but then internally you use contracts to enforce that the string is already input validated and you don't have to enforce edge cases.