Refuse a malformed limit on GET /api/admin/audit-events with 400

[Ayush7614]

auditQueryFromUrl matched digits but fell back to 50 on anything else, so ?limit=abc, ?limit=12abc, ?limit=3.9 and ?limit=-5 silently returned the default page while ?from=garbage on the same endpoint answered 400. Channels and people already answer 400 through parsePageLimit.

This reuses parsePageLimit(url limit, 100) and throws AuditQueryError on !ok, so the route's existing catch answers 400 naming the parameter. Absent/blank still means the default 50; digits still clamp 1..100. Also refreshes the paging.ts docstring, which described the old audit fallback.

Tests: new server/tests/audit-limit.test.ts (16 cases: defaults, boundaries, clamp, padding, 6 malformed shapes throwing + route 400 without reaching the store, valid limit reaching the store). Verified: audit cursor + limit + audit suite — 27 pass.

[davidmckayv]

Deep-reviewed clean (validation, no secret leak, fail-closed, agrees with existing layers). CI green.