refactor: modularize backend security and observability

backend/utils/coerce.js

@@ -0,0 +1,26 @@
+function normalizeNonNegativeInteger(rawValue, fallback = 0) {
+  const value = Number(rawValue);
+  if (!Number.isFinite(value) || value < 0) {
+    return Math.max(0, Number(fallback) || 0);
+  }
+  return Math.floor(value);
+}
+
+function parseBooleanLike(rawValue, fallback = false) {
+  if (rawValue === null || rawValue === undefined || rawValue === '') {
+    return fallback;
+  }
+  if (typeof rawValue === 'boolean') {
+    return rawValue;
+  }
+
+  const normalized = String(rawValue).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'off'].includes(normalized)) return false;
+  return fallback;
+}
+
+module.exports = {
+  normalizeNonNegativeInteger,
+  parseBooleanLike
+};