* fix: correct off-by-one error in parameterCount

The `parameterCount` function was counting `&` characters but returning
that count directly. Since the number of parameters equals the number
of `&` characters plus one, this caused an off-by-one error.

For example, with `a[0]=1&a[1]=2&...&a[199]=200` (200 parameters):
- Before: returned 199 (number of `&` chars)
- After: returns 200 (actual parameter count)

This bug became visible with [email protected] which changed `arrayLimit` to
restrict array length instead of max index. With the buggy count,
large arrays would be converted to objects instead of arrays.

- Fix `parameterCount` to return the actual count of parameters

Fixes #715

* deps(qs): bump to ~6.14.2

* refactor: use 2.x do/while loop for parameterCount

The previous while loop counted '&' separators, so the return value
was (parameter count - 1). That happened to work because old qs
treated `arrayLimit` as a max-index rather than max-length. The
limit check itself was always correct, only the return value was
off relative to the function's name.

Rather than patch with `+1`, port the 2.x version where `count`
directly represents parameter count. The do/while runs once
unconditionally for the first parameter (before any '&'), then
increments per '&' found.

do/while is safe because the caller at line 74 guards empty bodies
(`body.length ? queryparse(body) : {}`). If that guard were removed,
this would incorrectly return 1 for empty input.

Simple parser is unaffected, it only checks for `undefined` and
discards the count. Only the extended parser consumed the value,
as input to qs's `arrayLimit`.

* docs: update HISTORY.md

---------

Co-authored-by: Jon Church <[email protected]>