fix(assets): tighten job_ids — array schema, max_length, narrow except

From cursor-reviews on the parent commit:

- OpenAPI: declare job_ids as `type: array, items: string format: uuid`
  with `style: form, explode: true` so it matches the documented
  contract (and matches sibling include_tags/exclude_tags shape).
  Description now states both accepted shapes explicitly.
- Schema: cap `job_ids` at 500 entries (max_length on the Pydantic
  field) so a client can't splice an unbounded list into the IN clauses.
- Schema: drop `AttributeError` from the except — `raw` only contains
  `str` items by construction, so `uuid.UUID(<str>)` raises `ValueError`
  exclusively; the second clause was dead code.

app/assets/api/schemas_in.py

@@ -54,7 +54,7 @@ class ListAssetsQuery(BaseModel):
     include_tags: list[str] = Field(default_factory=list)
     exclude_tags: list[str] = Field(default_factory=list)
     name_contains: str | None = None
-    job_ids: list[str] = Field(default_factory=list)
+    job_ids: list[str] = Field(default_factory=list, max_length=500)
 
     # Accept either a JSON string (query param) or a dict
     metadata_filter: dict[str, Any] | None = None
@@ -105,7 +105,7 @@ class ListAssetsQuery(BaseModel):
         for s in raw:
             try:
                 canonical = str(uuid.UUID(s))
-            except (ValueError, AttributeError) as e:
+            except ValueError as e:
                 raise ValueError(f"job_ids must be UUIDs: {s!r}") from e
             if canonical not in seen:
                 seen.add(canonical)

openapi.yaml

@@ -1559,8 +1559,13 @@ paths:
         - name: job_ids
           in: query
           schema:
-            type: string
+            type: array
-          description: "Comma-separated UUIDs to filter assets by associated job."
+            items:
+              type: string
+              format: uuid
+          style: form
+          explode: true
+          description: "Filter assets by associated job UUIDs. Accepts repeated query params (e.g. `?job_ids=a&job_ids=b`) or a single comma-separated value (`?job_ids=a,b`)."
         - name: include_public
           in: query
           schema: