…uncaught-number-format-exception)

Each site called Integer/Long/Double parsing on a value that reaches it
without a surrounding catch, so malformed input escaped as a raw
NumberFormatException. Every site is now routed to the failure mode that
already fits its method contract, so callers get a controlled result
instead of a leaking runtime exception.

Untrusted / client input -> proper error:
- MemoryBackend.Cookie.valueOf: an invalid pagedResultsCookie now yields
  BadRequestException (HTTP 400) instead of a 500; the caller maps it to
  a failed promise.
- ElasticsearchAuditEventHandler.queryEvents: an invalid pagedResultsCookie
  now returns BadRequestException.asPromise() (400) instead of a 500.
- QueryFilterParser: a non-numeric assertion value now returns the parser's
  existing valueOfIllegalArgument() result instead of throwing.
- JwtClaimsSet: a non-numeric "exp" string claim now throws JwtRuntimeException
  (the class's own type-checking exception) with a clear message.

Configuration input -> clear message / documented default:
- AbstractJwtSessionModule: the token-idle-time and max-token-life settings
  are parsed via a helper that throws AuthenticationException naming the bad
  setting instead of a raw NumberFormatException.
- AsynchronousTextWriter: an invalid CAPACITY system property now logs a
  warning and falls back to the default (32000) instead of failing class init.
- RhinoScriptEngine: an invalid recompile-interval config value now logs a
  warning and falls back to the documented default (-1).
- CrestIntegerSchema.setExample: a non-integer example now throws
  ValidationException (the schema classes' idiom) instead of a raw NFE.

Sentinel-returning parsers -> existing sentinel:
- Key/KeyParser.unicode(): a malformed \uXXXX escape now returns the method's
  existing -1 "cannot parse" sentinel.
- JournalManager.fileToGeneration(): a non-numeric generation now returns the
  method's existing -1, matching the no-match branch.
- Warning.valueOf(): a non-numeric warn-code now returns null, matching the
  method's documented "null if it could not be parsed" contract.

Internal, developer-controlled specs -> loud but described failure:
- ManagementTableModel.setup() and AdminUI.addLabeledField(): a malformed
  column/component specification now throws IllegalArgumentException naming
  the offending spec instead of a bare NumberFormatException.

Behaviour is unchanged for valid input. Compiles: mvn -o -am compile across
all eleven affected modules -> BUILD SUCCESS.