fix(files): validate the list limit query parameter

[pacocartones]

Summary

• Validate the limit query parameter accepted by GET /v1/files.
• Return a structured 400 invalid_request_error response for non-integer, zero, negative, or oversized values.
• Preserve the existing default limit of 20 and maximum of 10,000.

Related Issues

• No linked issue.

Validation

CI will run the repository gates on this PR.

• Change type: other — Files API validation
• Focused tests and category gates from the golden path
• ESLint and Prettier checks on the changed files
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new automated test in this PR

Focused validation:

tests 38
pass 38
fail 0

The focused run covered:

• tests/integration/files-api-limit-validation.test.ts
• tests/integration/files-api.test.ts
• tests/unit/batch_api.test.ts

Tests Added Or Updated

• Added tests/integration/files-api-limit-validation.test.ts.

The test covers valid parsing, invalid limits, HTTP pagination behavior, and the HTTP 400 response.

Coverage Notes

The new integration test exercises both the query parser and the GET /v1/files route. The existing Files API and batch API suites also pass against this change.

Reviewer Notes

• No database migrations or feature flags.
• The maximum accepted value remains 10,000.

[diegosouzapw]

Thanks for this fix, @pacocartones — the base handler lets a negative limit (e.g. ?limit=-5) pass Math.min(parseInt(...)||20, 10000) unchanged, and a negative LIMIT ? in SQLite is unbounded (reachable today via omniroute files list --limit -5), so validating the param closes a real gap.

Items to confirm before merge (no rework needed if already covered by the diff):

1. Tests: please confirm the PR includes route-level coverage for the limit param (missing→default 20, 0/negative→rejected, non-integer/NaN→rejected, >10000→rejected/clamped, and the old unbounded-LIMIT regression). No route-level test for /v1/files exists today, so this is the main gate (Hard Rule fix(ci): add environment for npm token access #18).
2. Error shape: if invalid input returns a 400, keep it consistent with this file's existing OpenAI-style { error: { message, type } } body (as POST already does), a static message (no raw param echo / no err.stack), with CORS_HEADERS.
3. Nice-to-have (separate follow-up, not blocking): bin/cli/commands/files.mjs also passes the user's --limit through unclamped — worth the same guard client-side so files list --limit -5 surfaces a clean error.