perf: stabilize list queries for pilot

apps/api/tests/test_api.py

@@ -56,6 +56,14 @@ def test_invalid_period_is_rejected() -> None:
     assert client.get("/api/v1/activity?sort=unknown").status_code == 422
 
 
+def test_list_pagination_and_filter_validation() -> None:
+    assert client.get("/api/v1/fishes?limit=0").status_code == 422
+    assert client.get("/api/v1/fishes?limit=1&offset=0").status_code == 200
+    headers = {"Authorization": "Bearer change-me-in-production"}
+    assert client.get("/api/v1/admin/external-observations?status=unknown", headers=headers).status_code == 422
+    assert client.get("/api/v1/admin/catch-reports?offset=-1", headers=headers).status_code == 422
+
+
 def test_liveness_does_not_probe_dependencies() -> None:
     response = client.get("/health?token=must-not-be-logged")
     assert response.json() == {"status": "ok"}
@@ -80,6 +88,22 @@ def test_records_list_is_empty_before_import() -> None:
     assert response.json() == []
 
 
+def test_record_category_filter_is_applied_before_pagination() -> None:
+    with Session(engine) as db:
+        fish = db.scalar(select(Fish).where(Fish.slug == "pike"))
+        waterbody = db.scalar(select(Waterbody).where(Waterbody.slug == "test-lake"))
+        now = datetime.now(timezone.utc) - timedelta(days=30)
+        db.add_all([
+            CatchReport(fish=fish, waterbody=waterbody, weight_g=9000, caught_at=now, reported_at=now, source_type=SourceType.official_record, source_confidence=100, moderation_status=ModerationStatus.approved, raw_payload={"category": "other"}),
+            CatchReport(fish=fish, waterbody=waterbody, weight_g=8000, caught_at=now - timedelta(days=1), reported_at=now, source_type=SourceType.official_record, source_confidence=100, moderation_status=ModerationStatus.approved, raw_payload={"category": "wanted"}),
+        ])
+        db.commit()
+    response = client.get("/api/v1/records?category=wanted&limit=1")
+    assert response.status_code == 200
+    assert len(response.json()) == 1
+    assert response.json()[0]["category"] == "wanted"
+
+
 def test_user_report_requires_moderation_before_activity() -> None:
     created = client.post("/api/v1/catch-reports", json={"fish_slug": "pike", "waterbody_slug": "test-lake", "x": 77, "y": 88, "weight_g": 5500, "bait_name": "Новая приманка", "player_name": "Reporter"})
     assert created.status_code == 201