fn parse_wallet(raw: &str) -> Result<String, ApiError>Expand description
Parse+lowercase the wallet query string, rejecting anything that isn’t a
valid 0x-prefixed address. Parsing at the handler boundary keeps the
rate limiter’s wallet-based path reachable (it only kicks in when the
query parses as WalletAddress) and blocks a trivially-crafted 404-ish
DB-load vector against the notifications endpoint.