An ID on the command line is decimal digits only (closes #185)

files --collection, get, get-thumb and helper fix-missing-thumbnails
--file read an ID with Number(), so 0x10 meant 16, 1e3 meant 1000 and
an empty string meant 0, and --file dropped an ID it could not read.
parseID in src/cli-commands.ts now takes an ID only when it is decimal
digits and a safe integer; anything else prints "Invalid file ID: ARG"
or "Invalid collection ID: ARG" and the command exits 1. The fixer
checks every --file ID before it opens the library, so one bad ID fails
the whole command before any request.

Model: opus-5-5

README.md

@@ -626,6 +626,13 @@ exits 1, or 3 when the server no longer accepts the saved session (see "Session
 handling"). `--cache-dir` overrides where the cache lives; without it each
 account gets its own directory under the per-user cache path.
 
+An ID given to `files --collection`, `get`, `get-thumb` or
+`helper fix-missing-thumbnails --file` is written in decimal digits, no larger
+than 9007199254740991. Anything else, such as `0x10`, `1e3` or `-1`, is refused
+before any request with one line, `Invalid file ID: <arg>` or
+`Invalid collection ID: <arg>`, and exit status 1. One bad `--file` ID refuses
+the whole command, so nothing is fixed.
+
 `get` and `get-thumb` resolve the file by ID directly, so `--collection` is
 accepted for backward compatibility but ignored. For a live photo, `get` writes
 its image and its video, each named after the title with its own extension, as