Validate APB verse reference parameters

[hepplerj]

Summary

• require exactly one ref value before APB verse handlers access PostgreSQL
• share the validation and existing 400 response across verse, verse quotations, and verse trend handlers
• cover missing and repeated parameters for all three handlers with nil-database regression tests
• update the license year range through 2026

Compatibility

Successful APB requests and JSON response shapes are unchanged. Missing or repeated ref values now return 400 Bad Request instead of reaching panic recovery and returning 500 Internal Server Error.

Validation

• go test ./internal/datasets/apb -count=1
• go test . ./internal/... -count=1
• go test -race . ./internal/... -count=1
• go build ./...
• go vet ./...
• go mod verify
• go mod tidy -diff
• go test -run "^$" ./db
• go test ./cmd/apiary -count=1
• go test ./db -count=1
• local consumer smoke suite: 8,935 assertions passed

Closes #130