fix: prevent panics from unwrap calls and unsafe integer casts

[vieiralucas]

Summary

• DynamoDB streams poller: clamp batch_size before i64→usize cast to prevent wrapping on negative values
• DynamoDB: guard split_on_and/split_on_or with is_char_boundary checks to prevent panics on non-ASCII expression strings
• Step Functions: replace .unwrap() with graceful bail-out in set_at_path when intermediate path segments are non-objects
• API Gateway v2 CORS: replace all .parse().unwrap() with .parse().ok() on user-controlled header values to prevent panics on malformed CORS config
• API Gateway v2 HTTP proxy: clamp negative timeout before i64→u64 cast

Addresses unresolved Cubic findings from PRs #232, #257, #241, #255, #255.

Test plan

• cargo clippy --workspace --all-targets -- -D warnings passes
• All unit tests pass (cargo test -p fakecloud-stepfunctions -p fakecloud-apigatewayv2 -p fakecloud-dynamodb)
• New unit test for set_at_path non-object intermediate path

---

Summary by cubic

Removes several panic paths by replacing unsafe unwraps and clamping integer casts, improving resilience to malformed config and non-ASCII inputs without changing valid behavior.

• Bug Fixes
  • fakecloud-server (DynamoDB Streams poller): clamp batch_size with .max(0) before i64→usize cast.
  • fakecloud-dynamodb: guard split_on_and/split_on_or with is_char_boundary to avoid panics on UTF‑8 expressions.
  • fakecloud-stepfunctions: make set_at_path bail out when intermediate segments aren’t objects; added unit test.
  • fakecloud-apigatewayv2 (CORS): replace .parse().unwrap() with conditional inserts to avoid panics on malformed header values.
  • fakecloud-apigatewayv2 (HTTP proxy): clamp negative timeouts with .max(0) before i64→u64 cast.

^{Written for commit c8878b7. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 5 files