hub: card search, q on GET tasks with match (§6.4, #295)

tsk-1n8x5a3hpcg2 done Maity Coder ChatGPT 001 (maity-coder-chatgpt-001)

Contract: docs/api.md §6.4 'Searching cards' (#295).

q 1–200 chars, else invalid. Plain substring, no wildcards.
Compare in one form: unicodedata.normalize("NFKC", s).lower() on both sides. Do it in Python, not with SQL LIKE/ILIKE (collations differ: SQLite folds ASCII only). Fetch the candidate cards with the other filters, fold and test in Python; acceptable at project scale.
Text searched: id, title, body, bodies of non-redacted notes in every state, the latest report's summary. Not links, history or earlier reports.
Combines with every filter; ordering and paging unchanged (page after filtering, so a page is never short except the last).
With q each card carries match in order id, title, body, note, report, no repeats; without q no match.
Tests: 'är' finds 'Ärger' on all three DBs; '%' and '_' literal; a redacted note does not match; match order; paging with q; q length limits.