Validate route id parameters

[tukue]

Summary

Short description of the change and the problem it solves.

Changes

• List of major changes

Checklist

• Tests added/updated
• Lint and format checks passed (npm run lint && npm run format:check)
• Relevant documentation updated
• Database migrations added (if applicable)

Notes

Any additional notes for reviewers, deployment steps, or rollbacks.

[amazon-q-developer]

Summary

This PR successfully implements route parameter validation for ID fields across order, payment, and product routes, addressing a security improvement listed in PENDING_IMPROVEMENTS.md.

Key Changes:

• Added idParam validator using Zod's z.coerce.number().int().positive() to enforce positive integer IDs
• Integrated validation middleware on GET/:id, PUT/:id, and DELETE/:id endpoints
• Added comprehensive test coverage for invalid ID scenarios (returns 400 for non-numeric IDs)

Security Impact:
The validation prevents invalid ID formats from reaching controllers, reducing the risk of injection attacks and improving input sanitization. The coercion and validation ensure only positive integers are accepted as route parameters.

Testing:
Tests verify that invalid IDs (e.g., "not-a-number") return 400 ValidationError responses, confirming the validation layer works as expected.

✅ No blocking issues found. The implementation is secure and well-tested.

---

You can now have the agent implement changes and create commits directly on your pull request's source branch. Simply comment with /q followed by your request in natural language to ask the agent to make changes.