fix: sanitize v1 API pagination inputs and validate growth date

- v1/events GET: offset now clamped ≥0, limit fallback prevents NaN
  being passed to Prisma take/skip
- v1/growth POST: validate date is a valid ISO date before new Date()
  to avoid Invalid Date silently propagating into DB

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SECURITY_AUDIT.md

@@ -12,7 +12,7 @@
 |----------|-------|-------|
 | CRITICAL | 9     | 9     |
 | HIGH     | 11    | 10    |
-| MEDIUM   | 7     | 3     |
+| MEDIUM   | 7     | 5     |
 | LOW      | 1     | 0     |
 
 _Updated after second-pass audit (pass 2 of 2)._
@@ -199,6 +199,23 @@ If `SUPERADMIN_EMAIL` env var is not set, the condition `SUPERADMIN_EMAIL && ses
 
 ---
 
+### 23. `v1/events` GET — `offset` not sanitized (pass 2)
+**Fix:** `Math.max(0, parseInt(offset) || 0)`. Also fixed `limit`: `Math.min` of `NaN` returns `NaN`; added `|| 50` fallback.
+
+---
+
+### 24. `v1/growth` POST — date not validated before `new Date()`
+**Fix:** Added `if (isNaN(new Date(date).getTime())) return 400`.
+
+---
+
+## MEDIUM — Not applicable (already handled)
+
+### Upload route — extension from MIME type, not filename
+The audit flagged `upload/route.ts` for unsafe extension extraction. The route derives the extension from `file.type` (e.g., `"image/jpeg".split("/")[1]`) — not from the original filename — and `ALLOWED_TYPES.includes(file.type)` is checked before that line. No fix needed.
+
+---
+
 ## Routes verified as already secure
 
 - `webhooks/route.ts` — familyId from session, no cross-family access possible