fix(security): validate WHIP/WHEP OPTIONS path params

[birme]

Summary

• Add a TypeBox params schema to the WHIP OPTIONS handler (/whip/:productionId/:lineId) validating productionId and lineId (String, minLength 1, maxLength 200).
• Add the same params schema to the WHEP OPTIONS handler (/whep/:productionId/:lineId).
• Existing response schemas are preserved; no other handlers touched.

Test plan

• npm run typecheck clean
• npm test all pass (243 tests; "worker process has failed to exit gracefully" warning is expected)

Closes #249

[birme]

Code Review

Verdict: LGTM

Summary: Adds a TypeBox params schema (productionId/lineId, String, minLength 1, maxLength 200) to the WHIP and WHEP OPTIONS handlers, closing the AJV validation gap in #249. Minimal, correct, consistent with the maxLength-constraint convention used elsewhere in the codebase.

---

Blocking

None.

Warnings

None.

Suggestions

• src/api_whip.ts / src/api_whep.ts — the two handlers now carry an identical params schema; a shared constant would avoid drift, but duplication of a 4-line schema is acceptable.

---

daily-backlog-pr Phase 3 review. CI: all checks passing. Note: not auto-merging this run — see run summary.