test: add thread_id validation tests for replay API

- Test invalid thread_id with spaces returns 400
- Test thread_id with special chars returns 400
- Tighten existing 404 test assertion

backend/tests/unit/replay/test_api.py

@@ -156,5 +156,21 @@ class TestGetReplay:
 
         with TestClient(app) as client:
             resp = client.get("/api/replay/missing")
-        body = resp.json()
-        assert "detail" in body or "error" in body or resp.status_code == 404
+        assert resp.status_code == 404
+        assert "detail" in resp.json()
+
+    def test_invalid_thread_id_returns_400(self) -> None:
+        app = _build_app()
+        app.state.pool = _make_mock_pool([])
+
+        with TestClient(app) as client:
+            resp = client.get("/api/replay/id%20with%20spaces")
+        assert resp.status_code == 400
+
+    def test_thread_id_special_chars_returns_400(self) -> None:
+        app = _build_app()
+        app.state.pool = _make_mock_pool([])
+
+        with TestClient(app) as client:
+            resp = client.get("/api/replay/id;DROP TABLE")
+        assert resp.status_code == 400