fix: prevent DoS on search endpoint via query length limit and input validation

[fennhelloworld]

Fix for #1781: Prevent DoS on Search Endpoint

Vulnerability

The GET /api/search endpoint had no input validation or query length limit, allowing DoS attacks:

1. Memory exhaustion: An attacker could send arbitrarily long query strings (megabytes). The existing .slice(0, 200) silently truncated the output but still required Express to parse and allocate memory for the entire string.
2. ReDoS (Regular Expression Denial of Service): The search query accepted regex metacharacters (\, *, +, {, }, (, ), [, ], |, ^, $). If the search service later implements regex-based matching, these could trigger catastrophic backtracking.
3. No endpoint-specific rate limiting: Only a global API limiter (200 req/15min) protected the endpoint — insufficient for a resource-intensive search operation.

Changes

File	Change
validators/search.js	New — Zod schema enforcing max 200 chars and safe-characters-only regex; sanitizeSearchQuery() defense-in-depth function
middleware/validate.js	New — Generic validateQuery() middleware for Zod schema validation on query params
middleware/searchRateLimit.js	New — Dedicated search rate limiter: 20 req/min per IP (stricter than the global 200/15min)
routes/searchRoutes.js	Updated to use searchLimiter → validateQuery → search middleware chain; factory pattern for fresh limiter instances
controllers/searchController.js	Replaced silent .slice() truncation with sanitizeSearchQuery() (defense-in-depth after validation)
app.js	Updated to use createSearchRoutes() factory
tests/search.test.js	New — 7 tests covering: valid queries, empty queries, length rejection, ReDoS char rejection, allowed punctuation, sanitization, and rate limiting

Test Results

✓ GET /api/search with valid query returns 200
✓ GET /api/search without q param returns 200 with empty query
✓ GET /api/search rejects query longer than 200 characters
✓ GET /api/search rejects query with regex special characters
✓ GET /api/search accepts query with allowed punctuation
✓ sanitizeSearchQuery strips dangerous regex characters
✓ search endpoint rate limits after 20 requests

Defense Layers

1. Zod schema validation (middleware) — rejects queries >200 chars and disallowed chars with 400
2. Sanitization (controller) — strips any regex metacharacters as defense-in-depth
3. Rate limiting — 20 req/min per IP prevents brute-force search abuse
4. Global API limiter — 200 req/15min still applies as outer layer

Fixes #1781