Reject negative listKeyVersions page sizes

[tnull]

Summary

PostgresBackend::list_key_versions accepts a client-supplied signed i32
page_size, applies only an upper bound with min, and uses the result to form
a PostgreSQL LIMIT after adding one.

• page_size = -1 makes fetch_limit = 0, producing an unexpected empty page.
• page_size = i32::MIN remains negative and produces a PostgreSQL query error.

Observed on 88a5703496386465556d920dccf49512296c53d0 (current main).

Reproduction

Send an authenticated /vss/listKeyVersions protobuf request with a valid
store_id and page_size set first to -1, then to -2147483648. The former
returns empty pagination behavior; the latter reaches PostgreSQL with a
negative LIMIT and returns an internal/query error.

Impact

This is a low-severity input-validation and error-amplification issue. It does
not expose other tenants' data, but malformed client input reaches the database
and can generate avoidable errors.

Code evidence

impls/src/postgres_store.rs:662-689 performs:

let page_size = request.page_size.unwrap_or(i32::MAX);
// ...
let limit = min(page_size, LIST_KEY_VERSIONS_MAX_PAGE_SIZE) as i64;
let fetch_limit = limit + 1;

There is no lower-bound validation except for the separate page_size == 0
case.

Suggested remediation

Reject negative page sizes at the request boundary with an invalid-argument
response, and add tests for -1 and i32::MIN.

Reported by Bitcoin Red Team.