fix(time-travel): validate $as_of and $from_to at API boundary

[bhudevbhanpuriya]

Summary

The API supports $as_of and $from_to query parameters, but they were not validated at the request boundary.
Endpoints parsed CommonQueryParams but ignored it, forwarding raw query strings to STA2REST.convert_query().

This caused invalid inputs to fail late and inconsistently.

What’s changed

• Added validation in:

api/app/v1/endpoints/read/query_parameters.py

• Enforces:

    - valid ISO datetime for $as_of
    - $as_of not in the future
    - valid $from_to format (<start>/<end>)
    - start ≤ end
    - $as_of and $from_to cannot be used together
  

---

Before v After

---

Tests

Added unit tests in:

test/unit/test_query_parameters.py

Covers:

• valid inputs
• invalid $as_of
• future $as_of
• malformed $from_to
• reversed $from_to
• conflicting parameters

Why this is needed

• Ensures validation happens at the API contract layer
• Prevents late / inconsistent failures downstream
• Provides consistent HTTP 422 responses for invalid input
• Aligns implementation with documented time-travel behavior

Closes #174