Fix get_board on boards with more than 20 cards

GET /api/v3/cards?ids= accepts at most 20 ids. Above that the request
fails with 400 "each value in ids must be a mongodb id" — which blames
the ids when the real problem is how many there are. Express/NestJS
parse the query string with qs, whose default arrayLimit is 20; past it
the repeated params stop being an array and become an object keyed "0",
"1", …, and @IsMongoId({ each: true }) then rejects every value.

I had chunked at 40, having read the controller and its DTO and found no
documented ceiling. The limit is not there — it is in the query parser
underneath them, which I did not think to check. Verified live: 20 ids
return 200, 21 return 400 with identical ids.

The worse half of this was mine alone. The crawler caught assembleBoard
failures and dropped them, so every board over 20 cards vanished from
the index while the crawl reported "failures: none". Board errors now go
into Snapshot.failures and are surfaced by refresh_index.

Impact of both fixes on a full re-crawl: 205 files -> 255, and the
reported board (27 cards, 18 files) reads fully. The two failures that
remain are genuine 403s — boards this account cannot see — and are now
visible rather than silent.

Thanks to the bug report, which had the root cause exactly right.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/API.md

@@ -109,6 +109,16 @@ files-storage with `parentType: 'boardnodes'` and the **element** id as
 `parentId`. This is the single least discoverable part of the API, and applies
 equally to `fileFolder` and `drawing` elements.
 
+**`GET /cards?ids=` accepts at most 20 ids.** Above that the request fails with
+`400 "each value in ids must be a mongodb id"` — blaming the ids when the real
+problem is how many there are. Express/NestJS parse the query string with `qs`,
+whose default `arrayLimit` is 20; past it, repeated params become an object
+keyed `"0"`, `"1"`, … and `@IsMongoId({ each: true })` then rejects every value.
+Nothing in the controller or its DTO says so: the limit lives in the query
+parser underneath them. Verified live — 20 ids return 200, 21 return 400 with
+identical ids. A board with more than 20 cards is therefore unreadable in one
+request; `getCards` chunks at 20.
+
 **`storageLocationId` is the school id** (from `/me`), with
 `storageLocation: 'school'`, for every parent type in normal use.