fix: address code review findings

cmd/api/handlers.go

@@ -560,6 +560,10 @@ func GetSavedCities(hc *HandlerContext, w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	cities, err := hc.Preferences.GetSavedCities(r.Context(), userID)
 	if err != nil {
@@ -580,6 +584,10 @@ func AddSavedCity(hc *HandlerContext, w http.ResponseWriter, r *http.Request) {
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	var req struct {
 		CityCode string `json:"city_code"`
@@ -607,6 +615,10 @@ func RemoveSavedCity(hc *HandlerContext, w http.ResponseWriter, r *http.Request)
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	parts := strings.Split(r.URL.Path, "/")
 	// Expected: /v1/preferences/saved-cities/{city_code} -> parts: ["", "v1", "preferences", "saved-cities", "{city_code}"]
@@ -633,6 +645,10 @@ func GetSearchHistory(hc *HandlerContext, w http.ResponseWriter, r *http.Request
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	history, err := hc.Preferences.GetSearchHistory(r.Context(), userID)
 	if err != nil {
@@ -653,6 +669,10 @@ func AddSearchHistory(hc *HandlerContext, w http.ResponseWriter, r *http.Request
 	if userID == "" {
 		userID = "default"
 	}
+	if len(userID) > 100 {
+		http.Error(w, "invalid user_id format", http.StatusBadRequest)
+		return
+	}
 
 	var req struct {
 		FromCity string `json:"from_city"`