fix(api): reject reversed custom streak date ranges (JhaSourav07#1644)

## Description

Fixes JhaSourav07#1643

## Pillar

- [x] 🛠️ Other (Bug fix, refactoring, docs)

## What changed

The custom `from` and `to` parameters on `/api/streak` were validated
independently, so a reversed range such as
`from=2025-12-31&to=2025-01-01` passed schema validation and reached the
GitHub fetch path.

This PR adds object-level validation to `streakParamsSchema` so requests
with both dates present must satisfy:

```ts
Date.parse(from) <= Date.parse(to)
```

If the range is reversed, the route now returns a 400 validation
response before making any GitHub API request.

I also added a route regression test that verifies the reversed range is
rejected and `fetchGitHubContributions` is not called.

This is a GSSoC 2026 API bug fix contribution. Please add the relevant
GSSoC labels if they are missing.

## Visual Preview

N/A — this is API validation behavior.

## Local checks

```bash
npm run format:check
npm run lint
npm run test -- app/api/streak/route.test.ts
```

`npm run lint` reports one existing warning in
`components/ReturnToTop.test.tsx`; there are no lint errors.

## Checklist before requesting a review:

- [x] I have read the `CONTRIBUTING.md` file.
- [x] I have tested these changes locally.
- [x] I have run `npm run format` and `npm run lint` locally and
resolved all errors.
- [x] My commit follows the Conventional Commits format.
- [x] I have updated `README.md` if I added a new theme or URL
parameter.
- [x] I have starred the repo.
- [x] I have made sure that I have only one commit to merge in this PR.
- [x] The SVG output matches the CommitPulse quality standard.

Author: JhaSourav07

app/api/streak/route.test.ts

@@ -531,6 +531,19 @@ describe('GET /api/streak', () => {
       });
     });
 
+    it('returns 400 when custom from date is after custom to date', async () => {
+      const response = await GET(
+        makeRequest({ user: 'octocat', from: '2025-12-31', to: '2025-01-01' })
+      );
+      const body = await response.json();
+
+      expect(response.status).toBe(400);
+      expect(body.details.fieldErrors.to[0]).toContain(
+        '"to" date must be after or equal to "from" date'
+      );
+      expect(fetchGitHubContributions).not.toHaveBeenCalled();
+    });
+
     it('functions normally when the year parameter is missing', async () => {
       const response = await GET(makeRequest({ user: 'octocat' }));
 

app/api/wrapped/route.test.ts

@@ -150,6 +150,14 @@ describe('GET /api/wrapped', () => {
       expect(response.status).toBe(200);
       expect(body).toContain('rx="15"');
     });
+
+    it('hides the wrapped badge background when hide_background=1 is passed', async () => {
+      const response = await GET(makeRequest({ user: 'octocat', hide_background: '1' }));
+      const body = await response.text();
+
+      expect(response.status).toBe(200);
+      expect(body).toContain('fill="transparent"');
+    });
   });
 
   describe('cache-control header', () => {

lib/validations.ts

@@ -60,7 +60,7 @@ function dimensionParam(name: string, min: number, max: number) {
 
 const GITHUB_USERNAME_REGEX = /^[a-zA-Z0-9](?:[a-zA-Z0-9]|-(?=[a-zA-Z0-9]))*$/;
 
-export const streakParamsSchema = z.object({
+const baseStreakParamsSchema = z.object({
   // Required — missing user surfaces as "Missing" to match existing tests
   user: z
     .string({ error: 'Missing user parameter' })
@@ -243,6 +243,14 @@ export const streakParamsSchema = z.object({
   entrance: z.enum(['rise', 'fade', 'slide', 'none']).catch('rise').default('rise'),
 });
 
+export const streakParamsSchema = baseStreakParamsSchema.refine(
+  (data) => !data.from || !data.to || Date.parse(data.from) <= Date.parse(data.to),
+  {
+    message: '"to" date must be after or equal to "from" date',
+    path: ['to'],
+  }
+);
+
 export const githubParamsSchema = z.object({
   username: z
     .string({ error: 'Missing "username" parameter' })