fix: validate and limit search query input

[q404365631]

Summary

GET /api/search passed req.query.q directly to the search service without validation. An attacker could send extremely long query strings or non-string input.

Changes

• Add searchQuerySchema in apps/api/src/validators/search.js using Zod
• Query string is trimmed, length-limited to 200 characters, defaults to empty string
• Non-string input (e.g. repeated q parameters as array) is rejected
• Apply schema.parse() in searchController.js

Closes #2833

/claim #2833