Fix 304 response body, parse_url safety, and location/stock consistency

- Use empty Response instead of JsonResponse(null) for 304 Not Modified
  to avoid sending "null" as response body
- Guard parse_url() result with is_string() since it can return false
  for malformed URLs
- Move storage location tracking inside the availability check so
  expired and unknown-quantity lots don't contribute locations

src/Controller/KiCadApiController.php

@@ -97,7 +97,7 @@ class KiCadApiController extends AbstractController
         $etag = '"' . md5(json_encode($data)) . '"';
 
         if ($request->headers->get('If-None-Match') === $etag) {
-            return new JsonResponse(null, Response::HTTP_NOT_MODIFIED);
+            return new Response('', Response::HTTP_NOT_MODIFIED);
         }
 
         $response = new JsonResponse($data);