fix(infra): parseInt safety guards, remove duplicate code, JSON parse error handling, security hardening

[bsatrom]

Summary

Security hardening (previous commits):

• Replace manual string interpolation in rag-retrieval.ts and feedback.ts with RDS Data API parameterized queries — eliminates SQL injection vector
• Add cognito:groups Admin check to GET /analytics/feedback — closes authorization gap on endpoint that returns all users' query history
• Remove Aurora fallback in chat-query.ts that silently returned ALL device serial numbers when none provided — now returns 403

Defensive coding (new commits):

• Add parseIntParam helper to shared/utils.ts with NaN guard and max-value cap — replace unguarded parseInt() calls across 5 handler files (api-devices, api-alerts, api-telemetry, api-activity, api-journeys); bad input now returns default instead of propagating NaN into DynamoDB
• Remove duplicate getAllDeviceUidsForSerial from api-alerts and import the shared version from device-lookup.ts
• Wrap JSON.parse(event.body) in try/catch in mutation handlers in api-devices (mergeDevices, updateDeviceBySerial) and api-commands (sendCommand) — malformed JSON now returns 400 instead of 500
• Gate span lifecycle console.log calls in tracing.ts behind DEBUG_TRACING=true env var — reduces CloudWatch log volume in production
• Remove aws-marketplace:Subscribe / ViewSubscriptions from Lambda IAM role — Lambda should never subscribe to paid Marketplace products
• Replace Math.random() alert ID generation with crypto.randomUUID() — eliminates collision window at high throughput
• Add ACKNOWLEDGED shared constant for DynamoDB GSI partition key string values — prevents accidental boolean writes that break queries

Test plan

• GET /devices?limit=abc returns results with the default limit, not a 500
• GET /alerts?limit=999999 returns results capped at 500
• POST /devices/merge with invalid JSON body returns 400 with descriptive error
• POST /devices/{sn}/commands with invalid JSON body returns 400
• Alert queries return correct results (device lookup still works via shared function)
• Tracing spans still appear in Phoenix UI
• RAG retrieval still returns relevant documents for chat queries
• GET /analytics/feedback returns 403 for non-admin users
• Chat query without deviceSerialNumbers returns 403

🤖 Generated with Claude Code