security: second-pass ownership checks + input validation fixes

- medication-profiles/[id]: verify familyId ownership before PATCH/DELETE
- event-templates/[id]: verify familyId ownership before PATCH/DELETE
- notify/push: verify baby.familyId matches session family before push
- events GET: validate type against ALL_EVENT_TYPES allowlist; sanitize
  limit (1–500) and offset (≥0) to prevent NaN/unbounded queries
- v1/summary: fix operator precedence bug in feeds count calculation

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

SECURITY_AUDIT.md

@@ -11,10 +11,12 @@
 | Severity | Found | Fixed |
 |----------|-------|-------|
 | CRITICAL | 9     | 9     |
-| HIGH     | 6     | 5     |
-| MEDIUM   | 6     | 2     |
+| HIGH     | 11    | 10    |
+| MEDIUM   | 7     | 3     |
 | LOW      | 1     | 0     |
 
+_Updated after second-pass audit (pass 2 of 2)._
+
 ---
 
 ## CRITICAL — Fixed
@@ -145,6 +147,58 @@ If `SUPERADMIN_EMAIL` env var is not set, the condition `SUPERADMIN_EMAIL && ses
 
 ---
 
+---
+
+## HIGH — Fixed (pass 2)
+
+### 17. `medication-profiles/[id]` — no family ownership check
+**Affected:** PATCH and DELETE
+
+**Problem:** Any authenticated user could modify or delete any medication profile by ID.
+
+**Fix:** Added `prisma.medicationProfile.findFirst({ where: { id, familyId } })` check before PATCH and DELETE.
+
+---
+
+### 18. `event-templates/[id]` — no family ownership check
+**Affected:** PATCH and DELETE
+
+**Problem:** Any authenticated user could modify or delete any event template by ID.
+
+**Fix:** Added `prisma.eventTemplate.findFirst({ where: { id, familyId } })` check before PATCH and DELETE.
+
+---
+
+### 19. `notify/push` — no family ownership check on babyId
+**Problem:** Baby was fetched by ID but its `familyId` was never compared against the session user's family. Any authenticated user could trigger push notifications using another family's baby ID (leaking feeding status via the notification message).
+
+**Fix:** Added `if (baby.familyId !== sessionFamilyId) return 404`.
+
+---
+
+### 20. `events/route.ts` GET — event `type` not validated against allowlist
+**Problem:** The `type` query param was passed directly into the Prisma where clause without validation. While Prisma parameterizes values (no SQL injection), arbitrary strings could be stored and returned.
+
+**Fix:** Imported `ALL_EVENT_TYPES` from `event-config.ts` and added `if (type && !ALL_EVENT_TYPES.includes(type)) return 400`.
+
+---
+
+### 21. `events/route.ts` GET — `limit`/`offset` not sanitized
+**Problem:** `parseInt()` returns `NaN` on non-numeric input; `NaN` passed to Prisma `take`/`skip` causes an error or is treated as 0, potentially returning all rows.
+
+**Fix:** Added clamping: `limit = Math.max(1, Math.min(parseInt(limit) || 50, 500))`, `offset = Math.max(0, parseInt(offset) || 0)`.
+
+---
+
+## MEDIUM — Fixed (pass 2)
+
+### 22. `v1/summary` — arithmetic operator precedence bug
+**Problem:** `counts.BREASTFEED ?? 0 + (counts.BOTTLE ?? 0)` evaluated as `counts.BREASTFEED ?? (0 + (counts.BOTTLE ?? 0))` due to `??` precedence, causing incorrect feed count.
+
+**Fix:** Added explicit parentheses: `(counts.BREASTFEED ?? 0) + (counts.BOTTLE ?? 0)`.
+
+---
+
 ## Routes verified as already secure
 
 - `webhooks/route.ts` — familyId from session, no cross-family access possible