Specification of the search input (the module's only form element).
Backend constraints are exact from search-query.dto.ts; client rules are
(proposed) where marked. There is no multi-field form in this module.
Server-side validation fires only for non-string/negative/non-integer
params → 400 VALIDATION_ERROR with per-field details (00-shared/07 §3).
The client prevents these by construction (int types on page/limit,
string on q). No inline field errors exist on this input; failures surface
as screen-level AppErrorState (06 §2.5).
Regex fallback risk: the fallback builds { $regex: q, $options: 'i' }
from the raw query (search-index.repository.ts:40). Unescaped regex
metacharacters (( ) [ ] { } * + ? ^ $ | . \) can throw a server error on
that path. The client escapes nothing today — QA-14 §6 covers testing;
a client-side escape (proposed) is the mitigation.
Text-index behavior:$text tokenizes; punctuation is largely ignored
by Mongo (search-index.repository.ts:24-33) — so ADM-20 vs ADM 20
can return different results; fallback covers substring cases.