[Frontend] Add strict input validation to analytics date ranges

## Problem

Invalid, inverted, or extreme date ranges can create expensive backend queries and confusing charts.

## Relevant code

`src/pages/api/analytics, src/utils/dateRange.ts`

## Proposed scope

Validate format, ordering, maximum span, and timezone semantics with consistent 400 responses.

## Acceptance criteria

- [ ] The reported behavior is reproduced or characterized with a focused automated test before the fix.
- [ ] The implementation satisfies the proposed scope without weakening TypeScript, lint, authorization, privacy, or error handling.
- [ ] Success, empty/loading where applicable, failure, and boundary cases are covered.
- [ ] Existing related tests pass and new regression coverage is included.
- [ ] User-facing behavior remains accessible by keyboard and at mobile viewport sizes where UI is affected.
- [ ] Documentation is updated when the change alters configuration, contracts, security assumptions, or contributor workflow.

## Contributor notes

Base the work on the latest `main` branch. Keep unrelated refactors out of the pull request and include screenshots or recordings for visible changes. Never use real pet, medical, contact, wallet, or credential data in fixtures.

Start with the analytics API entry points under src/pages/api/analytics and the shared date-range logic in src/utils/dateRange.ts; first characterize invalid, inverted, extreme, and timezone-related inputs with focused automated tests. Done means consistent 400 responses, covered success, empty/loading, failure, and boundary cases, and passing related tests without weakening the stated safeguards.

Written by the indexing model from the issue text.