Reject negative multipart burn_after_reads via parseBurnAfterReads

internal/api/attachments.go

@@ -197,6 +197,12 @@ func (a *apiServer) handleCreatePasteMultipart(w http.ResponseWriter, r *http.Re
 				writeErrCode(w, 400, "burn_invalid", "burn_after_reads must be a positive number")
 				return
 			}
+			// negative values are invalid too: same 400 burn_invalid shape
+			// as the JSON path (validate.go:92), identical message text.
+			if err := parseBurnAfterReads(n); err != nil {
+				writeErrCode(w, 400, "burn_invalid", err.Error())
+				return
+			}
 			p.BurnAfterReads = &n
 		}
 	}