[api] fix missing playerevents endpoint

apps/api/src/http.ts

@@ -27,13 +27,27 @@ export function unauthorized(c: Context<App>) {
 	return c.body(null, 401)
 }
 
-/** Reads the `Ids` form field into a list of integer ids. */
+/**
+ * Reads the `Ids` form field of a bulk POST into a list of integer ids.
+ *
+ * BOTH spellings, because the client uses both: `Ids` REPEATED once per id
+ * (`Ids=101&Ids=102&Ids=103`, what the player-events bulk sends) and a single
+ * comma-separated `Ids=1,2,3`. `parseBody({ all: true })` is what keeps the repeated form
+ * from collapsing to its last value — plain `parseBody()` would answer one id out of
+ * three, which reads as a short result rather than as an error.
+ *
+ * `ids` is accepted alongside `Ids` so a hand-written request doesn't silently come back
+ * empty. Values that aren't integers are dropped; duplicates and order are left alone,
+ * since the caller renders them in request order.
+ */
 export async function parseFormIds(c: Context<App>): Promise<number[]> {
-	const body = await c.req.parseBody().catch(() => ({}) as Record<string, unknown>)
-	const ids = body.Ids
-	if (typeof ids !== 'string') return []
-	return ids
-		.split(',')
+	const body = await c.req
+		.parseBody({ all: true })
+		.catch(() => ({}) as Record<string, string | string[] | File | File[]>)
+	const raw = [body.Ids, body.ids].flat()
+	return raw
+		.filter((v): v is string => typeof v === 'string')
+		.flatMap((v) => v.split(','))
 		.map((s) => Number.parseInt(s.trim(), 10))
 		.filter((n) => !Number.isNaN(n))
 }