fix: harden notification pagination and ID validation

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/notifications/notifications.go

@@ -47,7 +47,7 @@ func GetNotifications(w http.ResponseWriter, r *http.Request) {
 	if p, err := strconv.Atoi(r.URL.Query().Get("page")); err == nil && p > 0 {
 		page = p
 	}
-	if pp, err := strconv.Atoi(r.URL.Query().Get("per_page")); err == nil && pp > 0 {
+	if pp, err := strconv.Atoi(r.URL.Query().Get("per_page")); err == nil && pp > 0 && pp <= 100 {
 		perPage = pp
 	}
 
@@ -211,13 +211,12 @@ func GetUnreadCount(w http.ResponseWriter, r *http.Request) {
 func AcknowledgeNotification(w http.ResponseWriter, r *http.Request) {
 	idStr := chi.URLParam(r, "id")
 	if idStr == "" {
-		http.Error(w, "Notification ID is required", http.StatusBadRequest)
+		http.Error(w, "missing notification ID", http.StatusBadRequest)
 		return
 	}
-
 	id, err := strconv.Atoi(idStr)
-	if err != nil {
-		http.Error(w, "Invalid notification ID", http.StatusBadRequest)
+	if err != nil || id <= 0 {
+		http.Error(w, "invalid notification ID", http.StatusBadRequest)
 		return
 	}