merge: combine all features from both codebases - mobile dashboard + layer panel + notifications + shares + all fixes

backend/src/routes/notifications.ts

@@ -4,6 +4,7 @@
 import type { FastifyInstance } from 'fastify';
 import type { DatabaseInterface } from '../database/DatabaseInterface.js';
 import type { AuthService } from '../auth/AuthService.js';
+import { validateIdParam } from '../utils/validation.js';
 
 function extractToken(request: any): string | null {
   const auth = request.headers?.authorization;
@@ -46,6 +47,8 @@ export function registerNotificationRoutes(fastify: FastifyInstance, db: Databas
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const notif = db.getNotification(id);
     if (!notif) return reply.code(404).send({ error: 'Notification not found' });
     if (notif.user_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });
@@ -61,6 +64,8 @@ export function registerNotificationRoutes(fastify: FastifyInstance, db: Databas
     const user = authService.getUserFromSession(token);
     if (!user) return reply.code(401).send({ error: 'Invalid or expired session' });
     const { id } = request.params as { id: string };
+    const idErr = validateIdParam(id, 'id');
+    if (idErr) return reply.code(400).send({ error: idErr });
     const notif = db.getNotification(id);
     if (!notif) return reply.code(404).send({ error: 'Notification not found' });
     if (notif.user_id !== user.id) return reply.code(403).send({ error: 'Forbidden' });