Cap catalog search queries and trim words without a regex - #1501

Summary

Catalog search trimmed the outer punctuation of every query word with /^[^a-z0-9À-�]+|[^a-z0-9À-�]+$/g. That regex is quadratic on a long run of punctuation between two letters: 30k characters take ~300 ms, so a few hundred thousand would block the event loop for many seconds. The query comes from the shared MCP tools (search_tools), the catalog search API and the support chat, and none of them limits its length. Found by code scanning (polynomial ReDoS in catalog-search.ts).

Changes

• queryWords reads at most MAX_QUERY_LENGTH (500) characters of the query.
• The outer punctuation is trimmed by index with the same character class (a-z, 0-9, À and up). Same words as before.
• packages/frontend/src/lib/catalog-search.ts is the same file (the spec checks that).
• toolPrefixFrom (File Search): runs of _ are already collapsed to one, so the trim is /^_|_$/g instead of /^_+|_+$/g. Same result; the second code scanning alert on that line was a false positive.

Cloud and self-hosted behave the same: queries longer than 500 characters are matched on their first 500.

Type

• Bug fix
• New feature
• Documentation
• Refactoring
• Performance improvement
• Other (describe below)

Testing

• Added/updated unit tests
• Tested manually (describe steps below)
• No tests needed (explain why)

New spec cases: trimming keeps inner punctuation (s/4hana), the length cap, and an 800k-character a!!!…a query through queryWords and searchCatalog in under 1 s.

In packages/backend:

• npx jest src/adapters/catalog-search.spec.ts src/file-search/file-search-config.spec.ts --maxWorkers=2 → 104 passed
• npx eslint on the changed files → exit 0
• npx tsc --noEmit -p tsconfig.json → exit 0

In packages/frontend: npx eslint src/lib/catalog-search.ts → exit 0. The full suite runs in CI.

Checklist

• My code follows the existing code style
• I have tested my changes locally
• I have updated documentation (if applicable)
• All existing tests pass (npm test)
• This PR has a descriptive title

Related Issues

Code scanning alerts 655 and 656.