fix(bounties): reject unknown status filter with 400 instead of silent active fallback (fixes #1099)

[aipd506]

Summary

Fixes #1099

Rejects unknown status query parameters on GET /api/bounties with a 400 Bad Request and an explicit error message containing valid_values, instead of silently falling back to the active set.

Problem

Previously, unrecognized status values (such as ?status=zzzz, ?status=completed, ?status=accepted) silently fell through to "active", returning a plausible 200 OK response with active bounties. This caused caller confusion and subtle statistics corruption when consumers queried what they believed were valid statuses.

Solution

1. In app/api/bounties/route.ts, if status is explicitly provided in query params and is not in STATUS_FILTER_VALUES, return 400 Bad Request with structured error details and allowed enum values.
2. Added unit tests in app/api/bounties/__tests__/route.test.ts verifying rejection of unknown statuses (status=zzzz) with 400, acceptance of supported status filters (status=open) with 200, and default fallback to "active" when the status param is omitted (?limit=10).

Contributor Attribution

1. Contributor: aipd506 aipd506@users.noreply.github.com
2. Profile: https://terminal.merit.systems/aipd506