fix(19): WR-07 reject route ids with trailing garbage via strict integer parse

apps/api/tests/routes/admin.test.ts

@@ -483,6 +483,19 @@ describe('PUT /api/admin/calendars/:id/shared', () => {
       .limit(1);
     expect(rowA.isShared).toBe(true);
   });
+
+  it('WR-07: rejects a calendar id with trailing garbage (e.g. "1abc") with 400', async () => {
+    const adminId = await seedUser('admin-shared-badid', true);
+    currentDevUserId = adminId;
+    const app = await getApp();
+
+    // parseInt('1abc', 10) === 1 would have silently accepted this; the strict
+    // Number.isInteger parse must reject it as a malformed id.
+    const res = await app.fetch(jsonRequest('PUT', '/api/admin/calendars/1abc/shared'));
+    expect(res.status).toBe(400);
+    const body = (await res.json()) as { error: string };
+    expect(body.error).toBe('Invalid calendar id');
+  });
 });
 
 // ===========================================================================