fix: validate numeric office id on money-supply route

Avoid TypeScript express param regex; return 404 for non-numeric ids like public.

Co-authored-by: Cursor <cursoragent@cursor.com>

services/settlement-middleware/src/api/routes/settlement.ts

@@ -101,10 +101,14 @@ export function createSettlementRouter(): Router {
     }
   });
 
-  router.get('/money-supply/:officeIdParam(\\d+)', async (req, res) => {
+  router.get('/money-supply/:officeIdParam', async (req, res) => {
     if (!requireApiKey(req, res)) return;
+    const requested = parseInt(req.params.officeIdParam, 10);
+    if (!Number.isFinite(requested)) {
+      res.status(404).json({ error: 'Not found' });
+      return;
+    }
     try {
-      const requested = parseInt(req.params.officeIdParam, 10);
       res.json(await getMoneySupply(settlementOfficeId(requested)));
     } catch (e) {
       res.status(400).json({ error: e instanceof Error ? e.message : String(e) });