feat: add normalized public search filters

Add strict public search numeric validation and URL-backed category and price filters to the catalog UI.

apps/api/src/modules/search/routes/public-search-routes.js

@@ -1,12 +1,15 @@
 import { createApplicationError } from '../../../shared/errors/application-error.js';
 
-function coerceNumber(value, fallback) {
+function coerceNumber(value, fieldName, fallback) {
   if (value === undefined || value === null || value === '') {
     return fallback;
   }
 
   const parsed = Number.parseInt(String(value), 10);
-  return Number.isNaN(parsed) ? fallback : parsed;
+  if (Number.isNaN(parsed) || String(parsed) !== String(value)) {
+    throw createApplicationError('INVALID_SEARCH_FILTER', `${fieldName} must be an integer.`, 400);
+  }
+  return parsed;
 }
 
 export async function registerPublicSearchRoutes(app, options) {
@@ -24,10 +27,10 @@ export async function registerPublicSearchRoutes(app, options) {
     const filters = {
       query: request.query.query,
       category: request.query.category,
-      minPriceMinor: coerceNumber(request.query.minPriceMinor, undefined),
-      maxPriceMinor: coerceNumber(request.query.maxPriceMinor, undefined),
-      page: coerceNumber(request.query.page, 1),
-      limit: coerceNumber(request.query.limit, 20),
+      minPriceMinor: coerceNumber(request.query.minPriceMinor, 'minPriceMinor', undefined),
+      maxPriceMinor: coerceNumber(request.query.maxPriceMinor, 'maxPriceMinor', undefined),
+      page: coerceNumber(request.query.page, 'page', 1),
+      limit: coerceNumber(request.query.limit, 'limit', 20),
       includeSold: request.query.includeSold === 'true' || request.query.includeSold === true,
     };