fix: bound concert tracking routes

[chubes4]

Summary

• mirror the Users-owned 1..100 history and attendee bounds in the shipped Extra Chill REST schemas
• remove absint coercion so negative, zero, malformed, and over-limit client values fail validation instead of changing meaning
• exercise the actual /extrachill/v1/concert-tracking routes for schema parity, defaults, boundaries, rejected inputs, and ability forwarding

Dependency

Companion to Extra-Chill/extrachill-users#226. Merge the Users canonical service/ability PR first, then this transport PR.

Verification

• scoped Homeboy PHPCS/lint: passed with zero findings (e1c63265-40ae-4741-8b53-ac8e5110fa51)
• PHP syntax: passed for the route and REST test
• git diff --check origin/main...HEAD: passed
• focused PHPUnit attempted, but WP Codebox failed before loading tests because Composer platform check references unavailable STDERR (57e94b70-37eb-4945-881f-ac3205bbffab)
• runner defect evidence: fix: make WP Codebox PHPUnit multisite bootstrap reliable homeboy-extensions#2305