- enforce server-side body cap via http.MaxBytesReader: oversized JSON
bodies are rejected with 413 instead of being fully decoded first
- negative burn_after_reads rejected with 400 (zero still = default 1)
- limit=0 explicitly maps to default page size; shared parseLimit clamp
for /api/public and /api/mine (huge/non-numeric values too)
- negative/non-numeric offset clamped to 0 via parseOffset (was
pass-through)
- regression tests in issue68_validation_test.go
expires_at/expires_in validation intentionally excluded: covered by #60.
