Structured query

POST /query runs rule patterns, then optional vector fallback. GET /search uses the same engine (handy for quick browser tests).