Every PATCH builds a patch object from the fields it recognises and then
updates with it. A body naming none of them leaves that object empty,
and drizzle refuses an UPDATE with no SET — so `PATCH /api/forms/<id>
{}` and four more routes answered "something went wrong" to an ordinary
caller mistake.

Read once in the host's onError, like a malformed uuid and an
unreadable date before it, and mirrored in the module harness so a
module's tests see what its users will: 400, "there is nothing in that
request to change".

Also a shared `dayAfter` for date-only filters. Four modules had
their own copy of the same five lines, each reading the value with a
bare `new Date`, so `?to=not-a-date` was a 500 in three of them.

Found by asking every route in the product for wrong things, on a
freshly installed instance carrying every module.