fix(anomaly): validate config bounds, reject unbounded window sizes, and map validation errors to 400 (closes #909)

[mopxam-art]

Overview

Closes #909 by adding upper and lower bounds checking to anomaly detection parameters in validateAnomalyConfig, rejecting unbounded window sizes (such as 1e15), requiring integer values for window size and baseline, enforcing that minBaseline <= trendWindowSize, and wrapping PUT /v1/anomaly/config so that AnomalyValidationError is cleanly translated to HTTP 400 Bad Request instead of an unhandled HTTP 500 error.

Changes

• src/lib/anomaly.ts:
  • Added upper bounds constants: MAX_SENSITIVITY_Z_SCORE = 20, MAX_TREND_WINDOW_SIZE = 1000, MIN_TREND_WINDOW_SIZE = 2, MAX_TREND_DEVIATION_PCT = 1000, MAX_MIN_BASELINE = 500.
  • Added integer checks and bound constraints on trendWindowSize and minBaseline.
  • Added cross-field invariant check: minBaseline cannot exceed trendWindowSize.
• src/routes/anomaly-admin.ts:
  • Wrapped PUT /config in try / catch block and passed AnomalyValidationError to next(badRequest(err.message)) (HTTP 400).
• src/middleware/errors.ts:
  • Added fallback handler for AnomalyValidationError in errorHandler mapping to HTTP 400 bad_request.
• src/__tests__/anomaly-admin-5d-matrix.test.ts:
  • Added 110 comprehensive tests covering boundaries, combinatorics, parameter variations, negative controls, and concurrent lifecycle updates.

Verification

• All 110 anomaly detection tests pass green (npx jest src/__tests__/anomaly-admin-5d-matrix.test.ts).
• TypeScript typecheck passes with 0 errors (npx tsc --noEmit).
• ESLint passes with 0 warnings/errors.
• Production build succeeds (npm run build).