Decode list-query parameters so encoded filters match rows

[cursor]

Problem

Conversation list already uses parse_query(), which percent-decodes and treats + as space. Lesson, todo, schedule, request, run, and admin-audit list handlers hand-rolled ? / & / = splitting and assigned the raw substring.

A standard client that sends GET /v1/lessons?q=rate%20limit (browser, curl --data-urlencode, fetch) searched for the literal rate%20limit and missed the row whose signature or lesson text is rate limit. The same gap applies to encoded status, agent_id, and numeric filters (limit=%35%30).

Fix

Route those handlers through parse_query() — the same decoder conversation list already uses. Behavior for unencoded ASCII queries is unchanged.

Tests

unit_http_util — encoded lesson q=, plus-as-space, todo status=in%5Fprogress, encoded numeric audit filters, last-wins repeats. 3/3 passed locally.

Independently mergeable against main (0456350). Code hunks (api_server.cpp list handlers, test_http_util.cpp) do not overlap #321–#335 (those are artifacts / A2A / event ingest / schedule resume invoker / compaction). CHANGELOG [Unreleased] will need a rebase after whichever sibling merges first.

  

---

Note

Low Risk
Localized refactor to shared query parsing with tests; behavior change only fixes incorrect filtering for URL-encoded clients and aligns list handlers with an existing code path.

Overview
List endpoints now percent-decode query filters the same way conversation list already did. Hand-rolled ? / & / = splitting in lesson, todo, schedule, request (list + SSE since_seq), run, and admin audit handlers is replaced with shared parse_query(), so values like q=rate%20limit, status=in%5Fprogress, + as space, and encoded numeric params (limit=%35%30) reach the store/search logic as decoded strings instead of literal %20 / %5F text that missed rows.

Adds unit_http_util (tests/test_http_util.cpp) covering url_decode, parse_query, last-wins repeats, and paths with no query string. CHANGELOG documents the fix under [Unreleased].

^{Reviewed by Cursor Bugbot for commit 59532fb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_d8e7c75f-b4da-4119-b03e-0c556ec6d370)