fix: harden notification pagination and ID validation

Ultraworked with Sisyphus (https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/notifications/notifications.go

@@ -47,7 +47,7 @@ func GetNotifications(w http.ResponseWriter, r *http.Request) {
 	if p, err := strconv.Atoi(r.URL.Query().Get("page")); err == nil && p > 0 {
 		page = p
 	}
-	if pp, err := strconv.Atoi(r.URL.Query().Get("per_page")); err == nil && pp > 0 {
+	if pp, err := strconv.Atoi(r.URL.Query().Get("per_page")); err == nil && pp > 0 && pp <= 100 {
 		perPage = pp
 	}
 
@@ -211,13 +211,12 @@ func GetUnreadCount(w http.ResponseWriter, r *http.Request) {
 func AcknowledgeNotification(w http.ResponseWriter, r *http.Request) {
 	idStr := chi.URLParam(r, "id")
 	if idStr == "" {
-		http.Error(w, "Notification ID is required", http.StatusBadRequest)
+		http.Error(w, "missing notification ID", http.StatusBadRequest)
 		return
 	}
-
 	id, err := strconv.Atoi(idStr)
-	if err != nil {
+	if err != nil || id <= 0 {
-		http.Error(w, "Invalid notification ID", http.StatusBadRequest)
+		http.Error(w, "invalid notification ID", http.StatusBadRequest)
 		return
 	}
 

backend/handlers/notifications/notifications_test.go

@@ -456,8 +456,8 @@ func TestNotifications_AcknowledgeInvalidID(t *testing.T) {
 		expectCode  int
 	}{
 		{"non_numeric_id", "abc", http.StatusBadRequest}, // Invalid format
-		{"negative_id", "-1", http.StatusNotFound},     // Valid int, not found
+		{"negative_id", "-1", http.StatusBadRequest},   // Invalid (non-positive)
-		{"zero_id", "0", http.StatusNotFound},           // Valid int, not found
+		{"zero_id", "0", http.StatusBadRequest},         // Invalid (non-positive)
 	}
 
 	for _, tt := range tests {