fix(events): reject malformed pagination cursors as 400 errors

Wraps DateTimeParseException from Instant.parse in IllegalArgumentException
so the controller maps it to 400. Also rejects cursors with empty
instance_id (trailing '|') which would otherwise produce a vacuous
keyset predicate.

cameleer-server-app/src/test/java/com/cameleer/server/app/storage/ClickHouseAgentEventRepositoryIT.java

@@ -227,4 +227,26 @@ class ClickHouseAgentEventRepositoryIT {
         assertThat(p2.data().get(0).instanceId()).isEqualTo("agent-z");
         assertThat(p2.hasMore()).isFalse();
     }
+
+    @Test
+    void queryPage_malformedCursor_invalidTimestamp_throws() {
+        String raw = "not-a-timestamp|agent-1";
+        String cursor = java.util.Base64.getUrlEncoder().withoutPadding()
+                .encodeToString(raw.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+
+        org.junit.jupiter.api.Assertions.assertThrows(
+                IllegalArgumentException.class,
+                () -> repo.queryPage(null, null, null, null, null, cursor, 10));
+    }
+
+    @Test
+    void queryPage_malformedCursor_emptyInstanceId_throws() {
+        String raw = "2026-04-01T10:00:00Z|";
+        String cursor = java.util.Base64.getUrlEncoder().withoutPadding()
+                .encodeToString(raw.getBytes(java.nio.charset.StandardCharsets.UTF_8));
+
+        org.junit.jupiter.api.Assertions.assertThrows(
+                IllegalArgumentException.class,
+                () -> repo.queryPage(null, null, null, null, null, cursor, 10));
+    }
 }