Make repository list() reject unrecognised filter names

Repository.list(**filters) let each implementation pick out the filter
names it understood and silently ignore the rest, so a typo or an
unsupported filter returned every row in the table instead of an error.

This was hit for real: LeaveWishRepository.list(parent_personal_data_uuid
=...) returns every wish in the database, because that implementation
only recognises workspace_id and child_id. A guard written on top of it
would have passed while checking nothing.

All ten implementations now validate against their supported set and
raise ValueError naming the offending key. ValueError rather than a
domain error because passing a filter that does not exist is a
programming bug to fix, not a runtime condition to handle -- it must not
become an HTTP 4xx.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RXMhc9nT6sNz1SL4j8dznL

backend/app/repositories/filter_validator.py

@@ -0,0 +1,24 @@
+"""Validates repository list() filters to catch typos and unsupported filter names.
+
+This helper raises ValueError when a caller passes a filter name the repository
+doesn't support, rather than silently ignoring it (which would return unfiltered data).
+"""
+
+
+def validate_filters(provided_filters: dict[str, object], supported_filters: set[str]) -> None:
+    """Raise ValueError if any provided filter is not supported.
+
+    Args:
+        provided_filters: dict of filters passed to list()
+        supported_filters: set of filter names the repository recognizes
+
+    Raises:
+        ValueError: if any provided_filters key is not in supported_filters
+    """
+    unsupported = set(provided_filters.keys()) - supported_filters
+    if unsupported:
+        unsupported_list = sorted(unsupported)
+        supported_list = sorted(supported_filters)
+        raise ValueError(
+            f"Unsupported filter(s): {unsupported_list}. This repository supports: {supported_list}"
+        )