Answer a nonsense filter with a 400, and sweep every list route for the rest

Wave 3. Six findings, one cause: `int(request.args.get('typeid'))` with nothing
catching the ValueError. The caller sent a bad argument and got
500 INTERNAL_ERROR plus a traceback in the log, which says the server is broken
when the truth is that 'abc' is not a number.

shopdb/utils/queryargs.intarg reads it and raises QueryArgError, which an
app-level handler answers as a 400 naming the argument. App-level on purpose: a
route should not have to remember, and forgetting was the entire defect. The
policy differs from get_pagination_params, which falls back to a default for a
bad page number - a nonsense page is harmless and the caller still wants their
list, but silently ignoring a nonsense FILTER returns rows they believe they
excluded.

The gate matters more than the six fixes. tests/test_core/test_bad_query_args.py
sweeps all 131 registered no-parameter GET routes under /api/ with twelve
argument shapes and fails on any 5xx. It found sites the test run had not
reported - statusid and locationid on /api/assets, the second asset-list route,
limit on the employee lookup and the printer supply history - because the
pattern is how a list filter gets written rather than a property of any one
route. Verified non-vacuous by planting the old `int(...)` back into
/api/machines: four tests fail.

Four usb routes are skipped by exact path, with the reason: they reach the
EXTERNAL cmmc_usb database, so their 500 in a test environment is a missing
database rather than an argument fault. That is the complete set - every usb
GET route calling cmmc_usb_connection - not a convenient subset.

One correction worth recording: the first pass rewrote every
`if x := request.args.get(...)` in the touched files, including text arguments,
so a search for 'ZZNOTHINGMATCHES' briefly became a 400. Caught by
test_list_search_identifiers. Only id-shaped arguments are integers.

Scope: product

plugins/printers/api/asset_routes.py

@@ -6,7 +6,7 @@ import re
 from flask import Blueprint, request, Response, current_app
 from flask_jwt_extended import jwt_required
 
-from shopdb.api import db, cache, Setting, Asset, AssetType, Vendor, Model, Communication, CommunicationType, AssetRelationship, RelationshipType, success_response, error_response, paginated_response, ErrorCodes, get_pagination_params, paginate_query
+from shopdb.api import db, cache, Setting, Asset, AssetType, Vendor, Model, Communication, CommunicationType, AssetRelationship, RelationshipType, success_response, error_response, paginated_response, ErrorCodes, get_pagination_params, paginate_query, intarg
 
 from ..models import Printer, PrinterType, ModelSupply, PrinterDriver, PrinterObservedQueue
 from ..models.model_supply import SUPPLY_TYPES, SUPPLY_COLORS, CAPACITY_TIERS
@@ -261,20 +261,20 @@ def list_printers():
         )
 
     # Type filter
-    if typeid := request.args.get('typeid', request.args.get('type_id')):
-        query = query.filter(Printer.printertypeid == int(typeid))
+    if (typeid := intarg('typeid', intarg('type_id'))) is not None:
+        query = query.filter(Printer.printertypeid == typeid)
 
     # Vendor filter
-    if vendor_id := request.args.get('vendorid', request.args.get('vendor_id')):
-        query = query.filter(Printer.vendorid == int(vendor_id))
+    if (vendor_id := intarg('vendorid', intarg('vendor_id'))) is not None:
+        query = query.filter(Printer.vendorid == vendor_id)
 
     # Location filter
-    if location_id := request.args.get('locationid', request.args.get('location_id')):
-        query = query.filter(Asset.locationid == int(location_id))
+    if (location_id := intarg('locationid', intarg('location_id'))) is not None:
+        query = query.filter(Asset.locationid == location_id)
 
     # Business unit filter
-    if bu_id := request.args.get('businessunitid', request.args.get('businessunit_id')):
-        query = query.filter(Asset.businessunitid == int(bu_id))
+    if (bu_id := intarg('businessunitid', intarg('businessunit_id'))) is not None:
+        query = query.filter(Asset.businessunitid == bu_id)
 
     # Sorting
     sort_by = request.args.get('sort', 'hostname')
@@ -2481,8 +2481,8 @@ def list_supply_models():
 
     if search := request.args.get('search'):
         query = query.filter(Model.modelnumber.ilike(f'%{search}%'))
-    if vendor_id := request.args.get('vendorid', request.args.get('vendor_id')):
-        query = query.filter(Model.vendorid == int(vendor_id))
+    if (vendor_id := intarg('vendorid', intarg('vendor_id'))) is not None:
+        query = query.filter(Model.vendorid == vendor_id)
     if request.args.get('withsupplies', '').lower() == 'true':
         query = query.having(supplycount > 0)
 
@@ -2755,7 +2755,7 @@ def supplies_forecast():
     )
 
     try:
-        days = max(1, min(365, int(request.args.get('days', 90))))
+        days = max(1, min(365, intarg('days', 90)))
     except (TypeError, ValueError):
         days = 90