fix: prevent D1 errors for long media folder searches

[ostenbom]

What does this PR do?

Draft implementation PR for review in the endformdev/emdash fork. No upstream PR has been opened.

Fixes media folder search returning HTTP 500 on Cloudflare D1 for long search terms. The repository wraps the normalized term in %…% and escapes literal wildcard characters. D1 limits LIKE patterns to 50 bytes, so a 49-character ASCII term already exceeds the limit; Unicode normalization and escaping can make shorter inputs fail too.

Reproduction on a Cloudflare fixture:

1. Create a media folder with a name containing 49 ASCII characters, such as "a".repeat(48) + "b".
2. Search for that complete term in the media library, or call the authenticated GET /_emdash/api/media/folders?q=... endpoint.
3. Before this fix, the database throws D1_ERROR: LIKE or GLOB pattern too complex: SQLITE_ERROR and the endpoint returns 500. The same search succeeds with the fix.

Use a parameterized literal substring predicate: instr on SQLite/D1 and strpos on PostgreSQL. This retains the existing normalization, complete search term, literal %/_/backslash matching, ordering and cursor pagination. It adds no queries or schema changes. Truncating the term would incorrectly return folders that share only its prefix.

Related issue/design: none; this is a reproduced bug fix.

Type of change

• Bug fix
• Feature (requires an accepted feature plan or RFC)
• Refactor (no behavior change)
• Translation
• Documentation
• Performance improvement
• Tests
• Chore (dependencies, CI, tooling)

Your connection to this change

• I use EmDash and ran into the problem this PR addresses
• I maintain a tool, dependency, or service that EmDash uses, and this change concerns that integration
• A Maintainer approved this specific change before I opened the PR

Encountered while exercising EmDash's media library against a built Cloudflare fixture for the Endform integration. Direct requests reproduced it without Endform. This PR is based on the fork's main and contains none of the benchmark configuration changes.

Checklist

• I have read CONTRIBUTING.md
• pnpm typecheck passes
• pnpm lint passes
• pnpm test passes (or targeted tests for my change)
• pnpm format has been run
• I have added/updated tests for my changes (if applicable)
• User-visible strings in the admin UI are wrapped for translation — not applicable; no UI strings or catalogs changed.
• I have added and reviewed the user-facing changeset
• New features link to their merged design PR — not applicable; bug fix.
• I have included screenshots below if this PR changes the UI — not applicable; database query change, with no UI layout or component changes.

AI assistance disclosure

• This PR includes AI-generated code or text — model/tool: Codex (GPT-6).

Screenshots / test output

Screenshots: not applicable; no UI components or layouts changed.

One regression test runs against real workerd/D1. It searches for a 49-character substring and excludes a folder differing only in the last character, guarding against both the D1 exception and accidental truncation. The shared search-test helper and extra SQLite/PostgreSQL cases have been removed to keep this patch small.

• Targeted D1 test: 1 passed.
• Root build, formatting, quick lint, type-aware lint with zero diagnostics, package typecheck and diff whitespace check passed.

No migration or configuration change is required.