fix(search): validate production origins and API queries

[llbbl]

Production search requests depend on Astro.site for same-origin validation even though the deployed configuration does not set it, which can reject legitimate browser searches. The same API route also bypasses the existing trimmed two-character query validator, allowing unnecessary embedding and database work.

Acceptance

• Legitimate same-origin browser POST requests are accepted in production whether or not an explicit Astro site value is configured, while cross-origin requests remain rejected.
• Search queries are trimmed and must contain at least two non-whitespace characters before embedding or database work begins.
• API tests cover configured and unconfigured production origins, malicious origins, one-character queries, whitespace-only queries, and valid trimmed queries.
• Formatting, linting, type checking, tests, local indexing, and the production build pass.

Tasks

• gh-73-1 - Fix production origin validation and add deployment-realistic tests.
• gh-73-2 - Apply shared search-query validation and add normalization/rejection tests.
• gh-73-3 - Run the full quality and build validation suite.