case 4716 - unit pick-list customer variant parsed as a number

UnitPickList.GetVariantCriteria put the value of a "customerid:<value>"
variant from the request into the query unparsed, reachable by any login
(security review F43, found during case 4712). The value is now parsed as a
long; anything else means no restriction, as 0 already did. The client's
format ("customerid: 5") still works.

Checked: new test fails on the old code, passes now; pick-list tests 10/10.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/AyaNova/PickList/UnitPickList.cs

@@ -139,8 +139,10 @@ namespace AyaNova.PickList
             switch (v[0])
             {
                 case "customerid":
-                    if (string.IsNullOrWhiteSpace(v[1]) || v[1] == "0") return string.Empty;
-                    return $"aunit.customerid = {v[1]}";
+                    //case 4716: the id goes into the SQL, so it must be a number (anything else: no restriction, as for 0)
+                    if (!long.TryParse(v[1].Trim(), System.Globalization.NumberStyles.Integer, System.Globalization.CultureInfo.InvariantCulture, out long customerId) || customerId == 0)
+                        return string.Empty;
+                    return $"aunit.customerid = {customerId}";
 
             }
             return string.Empty;