Security: Validate blog controller inputs (page param, blog ID)

Ran a claude /security-review, fixed two vulnerabilities

  Use a plug to resolve blog_id, returning a clean 404 for unknown blogs
  instead of raising with inspect(). Parse page param with Integer.parse
  so invalid values (non-numeric, negative, zero) fall back to page 1
  instead of crashing. Add 5 tests covering these cases.a

app/test/firehose_web/controllers/blog_test.exs

@@ -26,6 +26,34 @@ defmodule FirehoseWeb.BlogTest do
     end
   end
 
+  describe "input validation" do
+    test "GET /blog/nonexistent returns 404", %{conn: conn} do
+      conn = get(conn, "/blog/nonexistent")
+      assert html_response(conn, 404)
+    end
+
+    test "GET /blog/engineering?page=abc falls back to page 1", %{conn: conn} do
+      conn = get(conn, "/blog/engineering?page=abc")
+      assert html_response(conn, 200) =~ "Engineering Blog"
+    end
+
+    test "GET /blog/engineering?page=-1 falls back to page 1", %{conn: conn} do
+      conn = get(conn, "/blog/engineering?page=-1")
+      assert html_response(conn, 200) =~ "Engineering Blog"
+    end
+
+    test "GET /blog/engineering?page=0 falls back to page 1", %{conn: conn} do
+      conn = get(conn, "/blog/engineering?page=0")
+      assert html_response(conn, 200) =~ "Engineering Blog"
+    end
+
+    test "GET /blog/engineering/nonexistent-post returns 404", %{conn: conn} do
+      assert_raise Blogex.NotFoundError, fn ->
+        get(conn, "/blog/engineering/nonexistent-post")
+      end
+    end
+  end
+
   describe "release notes blog (HTML)" do
     test "GET /blog/releases returns HTML index", %{conn: conn} do
       conn = get(conn, "/blog/releases")