fix: pre-road audit (Phase 30) — upload-loop OSError, stats lock scope, server int guards

server/app.py

@@ -137,7 +137,11 @@ def portal_select_device():
         session.pop("selected_device_id", None)
         session.pop("selected_device_name", None)
         return jsonify(status="ok", message="Device selection cleared.")
-    dev = db.get_device_by_id(int(device_id))
+    try:
+        device_id = int(device_id)
+    except (TypeError, ValueError):
+        return jsonify(error="Invalid device_id."), 400
+    dev = db.get_device_by_id(device_id)
     if dev is None:
         return jsonify(error="Device not found"), 404
     session["selected_device_id"] = dev["id"]
@@ -860,7 +864,10 @@ def portal_trips_compat():
     device_id = _portal_device_id()
     if device_id is None:
         return jsonify(error="device not configured"), 404
-    limit = min(int(request.args.get("limit", 200)), 1000)
+    try:
+        limit = min(int(request.args.get("limit", 200)), 1000)
+    except (ValueError, TypeError):
+        limit = 200
     trips = db.list_trips(device_id, limit=limit)
     return jsonify(trips=trips)