fix: harden notification pagination and ID validation

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/notifications/notifications_test.go

@@ -456,8 +456,8 @@ func TestNotifications_AcknowledgeInvalidID(t *testing.T) {
 		expectCode  int
 	}{
 		{"non_numeric_id", "abc", http.StatusBadRequest}, // Invalid format
-		{"negative_id", "-1", http.StatusNotFound},     // Valid int, not found
-		{"zero_id", "0", http.StatusNotFound},           // Valid int, not found
+		{"negative_id", "-1", http.StatusBadRequest},   // Invalid (non-positive)
+		{"zero_id", "0", http.StatusBadRequest},         // Invalid (non-positive)
 	}
 
 	for _, tt := range tests {