fix(notifications): guard against null notificationId in dismiss action

Casting null to string caused PATCH to fire against /api/notifications/null/read
when the field was absent. Added an early-return fail(400) and a test that
submitting an empty form returns 400 without calling the API.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/routes/aktivitaeten/page.server.spec.ts

@@ -185,6 +185,13 @@ function makeActionEvent(formData: FormData): any {
 }
 
 describe('aktivitaeten/actions — dismiss-notification', () => {
+	it('returns fail(400, { error }) and does NOT call PATCH when notificationId is missing', async () => {
+		const result = await actions['dismiss-notification'](makeActionEvent(new FormData()));
+
+		expect(result).toMatchObject({ status: 400 });
+		expect(mockApi.PATCH).not.toHaveBeenCalled();
+	});
+
 	it('calls PATCH /api/notifications/{id}/read with the form-supplied notificationId', async () => {
 		mockApi.PATCH.mockResolvedValue({ response: { ok: true }, data: {} });
 		const fd = new FormData();