_as_doc_id returned None for a hostile id. That was guarded at the one
call site, but the helper could still be misused into "$in needs an
array" - and a caller who forgot the guard would have got an error
rather than a safe no-op.
It now returns an EMPTY LIST for anything that is not a reading id. An
empty list is a valid $in argument that matches nothing, so the helper
cannot produce a query error, cannot match every document, and cannot be
interpreted as a query operator.
Verified against the live database: a hostile id matches 0 documents and
updates 0 documents.
164 tests.
hermes
21fa0d9a12