fix: sanitize v1 API pagination inputs and validate growth date

- v1/events GET: offset now clamped ≥0, limit fallback prevents NaN
  being passed to Prisma take/skip
- v1/growth POST: validate date is a valid ISO date before new Date()
  to avoid Invalid Date silently propagating into DB

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/app/api/v1/growth/route.ts

@@ -33,6 +33,7 @@ export async function POST(req: Request) {
 
   const { babyId, date, weight, height, headCirc, notes } = body;
   if (!babyId || !date) return NextResponse.json({ error: "babyId and date are required" }, { status: 400 });
+  if (isNaN(new Date(date).getTime())) return NextResponse.json({ error: "Invalid date format" }, { status: 400 });
 
   const baby = await prisma.baby.findFirst({ where: { id: babyId, familyId: ctx.familyId } });
   if (!baby) return NextResponse.json({ error: "Baby not found" }, { status: 404 });