fix(18-04): clamp campaigns list limit param to [0, 200] (WR-02)

- Parse limit once with Number.isFinite instead of `|| 50`, so an explicit
  limit=0 is honored instead of silently replaced by the default
- Math.max/min clamps to [0, 200], preventing a negative limit from reaching
  the SQL LIMIT clause and raising an unhandled 500

app/api/phishing/campaigns/route.ts

@@ -28,7 +28,8 @@ export async function GET(request: NextRequest) {
 
   try {
     const url = request.nextUrl;
-    const limit = Math.min(parseInt(url.searchParams.get('limit') ?? '50', 10) || 50, 200);
+    const rawLimit = parseInt(url.searchParams.get('limit') ?? '50', 10);
+    const limit = Math.min(Math.max(Number.isFinite(rawLimit) ? rawLimit : 50, 0), 200);
     const offset = Math.max(parseInt(url.searchParams.get('offset') ?? '0', 10) || 0, 0);
     const status = url.searchParams.get('status');