fix(analytics): 命中处置ids上限+disposition枚举校验+排序断言

Co-Authored-By: Claude Code <noreply@anthropic.com>

yunke-server/app/api/routers/analytics.py

@@ -5,7 +5,7 @@ from typing import Annotated, Any, Literal
 
 import sqlalchemy as sa
 from fastapi import APIRouter, Depends, HTTPException, Query
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from app.analytics import health as health_svc
@@ -150,20 +150,24 @@ async def delete_word(session: SessionDep, word_id: int) -> dict:
 
 
 class DisposeIn(BaseModel):
-    ids: list[int]
+    # 巨 IN 列表会撞 MySQL max_allowed_packet 裸 500 → pydantic 层拦成干净 422
+    ids: list[int] = Field(max_length=1000)
     disposition: str
 
 
+DispositionParam = Literal["pending", "confirmed", "false_positive", "ignored"]
+
+
 @router.get("/sensitive/hits")
 async def list_hits(
     session: SessionDep,
-    disposition: str | None = None,
+    disposition: DispositionParam | None = None,
     word_id: int | None = None,
     page: int = Query(1, ge=1),
     page_size: int = Query(20, ge=1, le=100),
 ) -> dict:
     """C1 命中列表——不传 disposition 默认只回 pending+confirmed(治理闭环:
-    处置完即出队列);word_id 供词详情下钻。"""
+    处置完即出队列);word_id 供词详情下钻。disposition 拼错 422 不静默空列表。"""
     return await hits_svc.list_hits(
         session, disposition=disposition, word_id=word_id,
         page=page, page_size=page_size,