Audit log endpoints return 500 on PostgreSQL when the cursor is not a valid audit log id #8879

Current Behavior

Requesting any audit log with a cursor that is not a valid audit log hashid returns a 500 on PostgreSQL:

SequelizeDatabaseError: invalid input syntax for type integer: ""

AuditLog.decodeHashid() does not return null for an invalid hashid, it returns an empty array. forEntity and forTimelineHistory in forge/db/models/AuditLog.js pass that straight into { id: { [Op.lt]: ... } }, which Sequelize renders as WHERE "id" < ''. PostgreSQL rejects the comparison. SQLite accepts it and silently returns an empty page, so the bug does not show up in local development.

Affected routes, all of which call forEntity or forTimelineHistory:

• GET /api/v1/teams/:teamId/audit-log (and its export)
• GET /api/v1/applications/:applicationId/audit-log (and its export)
• GET /api/v1/projects/:instanceId/audit-log (and its export)
• GET /api/v1/devices/:deviceId/audit-log (and its export)
• GET /api/v1/admin/audit-log (and its export)
• the instance and device history timeline routes

Seen in production as Sentry FLOWFUSE-BACKEND-D4.

Expected Behavior

An invalid cursor returns a 400 with a clear error code, the same on PostgreSQL and SQLite, instead of a 500 with a raw database error.

Steps To Reproduce

1. Run the platform against PostgreSQL.
2. GET /api/v1/teams/<teamId>/audit-log?cursor=abc as a team member.
3. The response is a 500 and the log shows invalid input syntax for type integer: "".

On SQLite the same request returns 200 with an empty log array.

Suggested Fix

In both cursor branches of forge/db/models/AuditLog.js, take the first decoded value and reject the request when there is none, then map that to a 400 in the routes. A unit test should cover an invalid cursor on both forEntity and forTimelineHistory.