fix(payments,portfolio,scheduling): add ID validation hardening

Add validators.IsValidID() checks on URL param IDs to return 404 instead of 400 for invalid IDs. Add offset cap and query length limit in portfolio images handler.

Ultraworked with [Sisyphus](https://github.com/code-yeongyu/oh-my-openagent)

Co-authored-by: Sisyphus <clio-agent@sisyphuslabs.ai>

backend/handlers/scheduling/time-blockers.go

@@ -169,8 +169,8 @@ func CreateTimeBlocker(w http.ResponseWriter, r *http.Request) {
 // DELETE /api/admin/time-blockers/{id}
 func DeleteTimeBlocker(w http.ResponseWriter, r *http.Request) {
 	id := chi.URLParam(r, "id")
-	if id == "" {
-		http.Error(w, "missing id parameter", http.StatusBadRequest)
+	if id == "" || !validators.IsValidID(id) {
+		http.Error(w, "time blocker not found", http.StatusNotFound)
 		return
 	}