feat: add name substring search to GET /v1/places

[koinsaari]

Adds a q query param that ILIKE-matches place names, composing with the existing proximity/bbox/default modes and cursor pagination. Escapes LIKE metacharacters (%, _, \) so search terms are matched literally, and adds a pg_trgm GIN index on places.name.

Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com

[claude]

Claude finished @koinsaari's task in 2m 8s —— View job

---

Review complete

• Read REVIEW.md and CLAUDE.md
• Review diff against origin/main
• Check core invariants (pure data layer, AuditFlags determinism, validation ordering, stdlib-only HTTP)
• Check SQL/query safety (LIKE escaping, parameterization)
• Check JSONB Valuer/Scanner symmetry (n/a — untouched by this PR)
• Check test coverage for new code paths
• Post final review and set commit status

No blocking issues. This is a clean, well-scoped read-path addition.

What I checked:

• q is composed correctly with all three existing filter modes (proximity/bbox/default) and cursor pagination — scope.Where(...) is chained before the mode switch, so conditions AND together correctly (cmd/api/main.go:233-247).
• ILIKE ? ESCAPE '\\' is fully parameterized — no string concatenation of user input into SQL.
• escapeLikePattern (cmd/api/main.go:198-201) uses strings.NewReplacer, which replaces \, %, _ simultaneously against the original string rather than sequentially — so escaping \ first doesn't get re-escaped when %/_ are substituted. Correct.
• Validation ordering is fine: structural validation (blank/whitespace-only q) runs before the query is issued; this PR doesn't touch the a11y/write path at all (read-only endpoint), so the validation→a11y invariant doesn't apply here.
• No HTTP framework introduced; still stdlib net/http via the generated strict server.
• pg_trgm extension creation in the migration follows the same CREATE EXTENSION IF NOT EXISTS pattern already established for PostGIS in 000001_create_places.up.sql.
• Test coverage is thorough: case-insensitive substring match, no-match, unescaped % and _ literal-match cases, and composition with bounding-box filtering (cmd/api/places_integration_test.go), plus blank/whitespace validation unit tests.

No Important findings, no Nits.

⚠️ Note: I attempted to set the claude-code-review commit status on the HEAD SHA but the GitHub App token doesn't have the statuses: write permission (403 Resource not accessible by integration). Someone with repo admin access will need to grant that permission for automated status checks to work.