Query-string parsing helpers shared across controllers.

The previous per-controller qs_integer/3 helpers called binary_to_integer/1 directly; bad input (?limit=abc) raised badarg, Cowboy's default error handler returned 500, and an attacker could flood the error logs.

integer/3 returns the default on parse failure. integer/5 additionally clamps to [Min, Max] so a malicious ?limit=10000000 cannot pull megabytes of rows. F-15 / F-21.