Treat % and _ as literals in lesson substring search

[cursor]

Problem

search_lessons documents a case-insensitive substring match (GET /v1/lessons?q=, /lesson search, constitution help). The implementation wrapped the query in LIKE %q% without escaping % / _ / \, so those characters were SQL wildcards.

A search for 100% matched use 1000 CPU as well as use 100% CPU. A search for foo_bar matched fooXbar. After #336 decodes q=100%25 to 100%, this over-match becomes the HTTP path too.

This is not SQL injection (the pattern is bound), but it violates the substring contract and can surface the wrong lessons.

Fix

Escape \, %, and _ in the query and pair both LIKE predicates with ESCAPE '\'. Unescaped ASCII queries without those characters are unchanged.

Memory tag= LIKE is left alone (separate filter; snake_case tags are a follow-up).

Tests

unit_lessons 6/6 locally (53 assertions) + ASan/UBSan. Existing substring / ranking cases still pass; new case covers %, _, \, and a multi-word substring that still matches.

Independently mergeable against main (0456350). Code hunks (like_literal helper + search_lessons SQL, test_lessons.cpp) do not overlap #321–#352 (search_lessons and the bytes_to_hex insertion point are identical on #322/#330/#331/#332/#348). CHANGELOG [Unreleased] will sibling-conflict after the first of those merges, same as the rest of the series.

  

---

Note

Low Risk
Localized query-pattern change with tests and docs; no auth or data-migration impact.

Overview
Lesson search now treats %, _, and \ as literal characters instead of SQLite LIKE wildcards for GET /v1/lessons?q= and /lesson search.

TenantStore::search_lessons adds a like_literal helper that backslash-escapes those metacharacters, lowercases the query as before, and binds patterns with LIKE … ESCAPE '\'. Queries without those characters behave the same; searches like 100% or foo_bar no longer over-match unrelated signatures.

API docs and the changelog note the literal-substring contract. A new unit test covers %, _, \, and normal multi-word substrings.

^{Reviewed by Cursor Bugbot for commit 7a6822a. Bugbot is set up for automated code reviews on this repo. Configure here.}