HTTP API: its own 400 for a query that cannot be read (closes #5)

GET /api/v1/chats/{id}/messages answered any query that does not
decode, such as one holding ; or %zz, with the sentence about count,
even when count was valid or absent. It now answers such a query with
"the query cannot be read", and keeps the count sentence for a count
that decodes but is not a whole number from 1 to 100. The README names
both cases.

Model: opus-5-5

internal/api/messages.go

@@ -70,7 +70,16 @@ func (h *handlers) handleMessages() http.HandlerFunc {
 			return
 		}
 
-		count, ok := messageCount(r)
+		// Not r.URL.Query, which drops a pair it cannot decode and so
+		// would turn count=1% into the default.
+		query, err := url.ParseQuery(r.URL.RawQuery)
+		if err != nil {
+			h.respondError(w, http.StatusBadRequest, "the query cannot be read")
+
+			return
+		}
+
+		count, ok := messageCount(query)
 		if !ok {
 			h.respondError(w, http.StatusBadRequest,
 				"count must be a whole number from 1 to "+strconv.Itoa(maxCount))
@@ -181,16 +190,9 @@ func (h *handlers) respondChatError(
 	}
 }
 
-// messageCount returns the request's count, defaultCount if it has none,
-// and false if it is anything but a whole number from 1 to maxCount. The
-// query is parsed here because r.URL.Query drops a pair it cannot
-// decode, which would turn count=1% into the default.
-func messageCount(r *http.Request) (int, bool) {
-	query, err := url.ParseQuery(r.URL.RawQuery)
-	if err != nil {
-		return 0, false
-	}
-
+// messageCount returns the query's count, defaultCount if it has none,
+// and false if it is anything but a whole number from 1 to maxCount.
+func messageCount(query url.Values) (int, bool) {
 	if !query.Has("count") {
 		return defaultCount, true
 	}