fix: validate cron expression before writing to crontab

tests/test_api.py

@@ -164,6 +164,22 @@ def test_set_alarm_rejects_custom_command():
     assert "command" in str(res.json()["errors"])
 
 
+def test_set_alarm_rejects_invalid_cron_expression():
+    """Invalid cron expressions must be rejected at the API boundary."""
+    headers = {"X-API-Key": "test-secret"}
+    mutation = """
+    mutation {
+      setAlarm(cronExpression: "definitely not valid") {
+        id
+      }
+    }
+    """
+    res = client.post("/graphql", json={"query": mutation}, headers=headers)
+    assert res.status_code == 200
+    assert "errors" in res.json()
+    assert "Invalid cron expression" in str(res.json()["errors"])
+
+
 def test_graphql_workflow():
     headers = {"X-API-Key": "test-secret"}