test: add validation and boundary tests for GraphController coverage

Cover the new input validation (invalid NodeKind → 400), negative offset
clamping, and limit capping on /kinds, /nodes, and /edges endpoints to
satisfy SonarCloud 80% new code coverage gate.

Co-Authored-By: Paperclip <noreply@paperclip.ing>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: 3 people

src/test/java/io/github/randomcodespace/iq/api/GraphControllerTest.java

@@ -114,6 +114,34 @@ void nodesByKindShouldAcceptPaginationParams() throws Exception {
                 .andExpect(jsonPath("$.limit").value(25));
     }
 
+    @Test
+    void nodesByKindShouldReturn400ForInvalidKind() throws Exception {
+        mockMvc.perform(get("/api/kinds/not_a_real_kind"))
+                .andExpect(status().isBadRequest());
+    }
+
+    @Test
+    void nodesByKindShouldClampNegativeOffset() throws Exception {
+        Map<String, Object> result = new LinkedHashMap<>();
+        result.put("kind", "endpoint");
+        result.put("nodes", List.of());
+        when(queryService.nodesByKind("endpoint", 50, 0)).thenReturn(result);
+
+        mockMvc.perform(get("/api/kinds/endpoint?offset=-5"))
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    void nodesByKindShouldCapLimitTo1000() throws Exception {
+        Map<String, Object> result = new LinkedHashMap<>();
+        result.put("kind", "endpoint");
+        result.put("nodes", List.of());
+        when(queryService.nodesByKind("endpoint", 1000, 0)).thenReturn(result);
+
+        mockMvc.perform(get("/api/kinds/endpoint?limit=5000"))
+                .andExpect(status().isOk());
+    }
+
     // --- /api/nodes ---
 
     @Test
@@ -140,6 +168,34 @@ void listNodesShouldFilterByKind() throws Exception {
                 .andExpect(jsonPath("$.count").value(0));
     }
 
+    @Test
+    void listNodesShouldReturn400ForInvalidKind() throws Exception {
+        mockMvc.perform(get("/api/nodes?kind=bogus_kind"))
+                .andExpect(status().isBadRequest());
+    }
+
+    @Test
+    void listNodesShouldClampNegativeOffset() throws Exception {
+        Map<String, Object> result = new LinkedHashMap<>();
+        result.put("nodes", List.of());
+        result.put("count", 0);
+        when(queryService.listNodes(null, 100, 0)).thenReturn(result);
+
+        mockMvc.perform(get("/api/nodes?offset=-10"))
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    void listNodesShouldCapLimitTo1000() throws Exception {
+        Map<String, Object> result = new LinkedHashMap<>();
+        result.put("nodes", List.of());
+        result.put("count", 0);
+        when(queryService.listNodes(null, 1000, 0)).thenReturn(result);
+
+        mockMvc.perform(get("/api/nodes?limit=9999"))
+                .andExpect(status().isOk());
+    }
+
     // --- /api/nodes/{nodeId}/detail ---
 
     @Test
@@ -208,6 +264,30 @@ void listEdgesShouldReturnEdges() throws Exception {
                 .andExpect(jsonPath("$.total").value(0));
     }
 
+    @Test
+    void listEdgesShouldClampNegativeOffset() throws Exception {
+        Map<String, Object> result = new LinkedHashMap<>();
+        result.put("edges", List.of());
+        result.put("count", 0);
+        result.put("total", 0);
+        when(queryService.listEdges(null, 100, 0)).thenReturn(result);
+
+        mockMvc.perform(get("/api/edges?offset=-3"))
+                .andExpect(status().isOk());
+    }
+
+    @Test
+    void listEdgesShouldCapLimitTo1000() throws Exception {
+        Map<String, Object> result = new LinkedHashMap<>();
+        result.put("edges", List.of());
+        result.put("count", 0);
+        result.put("total", 0);
+        when(queryService.listEdges(null, 1000, 0)).thenReturn(result);
+
+        mockMvc.perform(get("/api/edges?limit=5000"))
+                .andExpect(status().isOk());
+    }
+
     // --- /api/ego/{center} ---
 
     @Test