Notifications endpoint accepts negative offset

[forgou37]

The GET /api/notifications endpoint parses offset without clamping it to a non-negative value.

Repro

GET /api/notifications?offset=-10

Observed:

• const offset = Number(searchParams.get("offset")) || 0 — Number("-10") is -10 which is truthy, so the || 0 fallback is skipped
• offset = -10 is passed to .range(-10, limit - 11), causing a Supabase database error (500)

Fix

Clamp offset to a minimum of 0:

const offset = Math.max(0, Number(searchParams.get("offset")) || 0);

[Jorel97]

Submitted PR #306 for this: #306

Scope: clamp notification offset to a minimum of 0 before .range(...); I also bounded limit to 1..100 so invalid limit values cannot create inverted ranges.