fix: sanitize v1 API pagination inputs and validate growth date

- v1/events GET: offset now clamped ≥0, limit fallback prevents NaN
  being passed to Prisma take/skip
- v1/growth POST: validate date is a valid ISO date before new Date()
  to avoid Invalid Date silently propagating into DB

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/v1/events/route.ts

@@ -18,8 +18,8 @@ export async function GET(req: Request) {
   const type = searchParams.get("type");
   const from = searchParams.get("from");
   const to = searchParams.get("to");
-  const limit = Math.min(parseInt(searchParams.get("limit") ?? "50"), 500);
-  const offset = parseInt(searchParams.get("offset") ?? "0");
+  const limit = Math.max(1, Math.min(parseInt(searchParams.get("limit") ?? "50") || 50, 500));
+  const offset = Math.max(0, parseInt(searchParams.get("offset") ?? "0") || 0);
 
   if (!babyId) return NextResponse.json({ error: "babyId is required" }, { status: 400 });
 

src/app/api/v1/growth/route.ts

@@ -33,6 +33,7 @@ export async function POST(req: Request) {
 
   const { babyId, date, weight, height, headCirc, notes } = body;
   if (!babyId || !date) return NextResponse.json({ error: "babyId and date are required" }, { status: 400 });
+  if (isNaN(new Date(date).getTime())) return NextResponse.json({ error: "Invalid date format" }, { status: 400 });
 
   const baby = await prisma.baby.findFirst({ where: { id: babyId, familyId: ctx.familyId } });
   if (!baby) return NextResponse.json({ error: "Baby not found" }, { status: 404 });