Impove export validation

[mzur]

Exporting everything does not really make sense. On large instances it is not possible and on small instances "everything" can be selected with "only".

[Copilot]

Pull request overview

This PR tightens the export API so that exporting “everything” is no longer allowed; callers must provide either an inclusion (only) or exclusion (except) filter, with request validation centralized in a new FormRequest.

Changes:

• Added ShowExport FormRequest to parse/validate only/except query filters.
• Updated the shared export controller to use the FormRequest and apply filtered whereIn/whereNotIn queries.
• Updated export controller tests to reflect the new validation behavior and cover invalid filter inputs.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tests/php/Http/Controllers/Api/Export/VolumeExportControllerTest.php	Adjusts tests to require only/except and adds invalid-filter assertions.
tests/php/Http/Controllers/Api/Export/UserExportControllerTest.php	Adjusts tests to require only/except, changes expected exported set, adds invalid-filter assertions.
tests/php/Http/Controllers/Api/Export/LabelTreeExportControllerTest.php	Adjusts tests to require only/except and adds invalid-filter assertions.
app/Http/Requests/ShowExport.php	New FormRequest for parsing/validating export filters.
app/Http/Controllers/Api/Export/VolumeExportController.php	Updates API docs to state a filter is required.
app/Http/Controllers/Api/Export/UserExportController.php	Updates API docs to state a filter is required.
app/Http/Controllers/Api/Export/LabelTreeExportController.php	Updates API docs to state a filter is required.
app/Http/Controllers/Api/Export/Controller.php	Switches to ShowExport and applies parsed filter arrays to the query.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.