fix: escape LIKE wildcards in user-search ILIKE queries

A `%` or `_` in a search term silently acted as a LIKE wildcard rather than
matching literally (`50%` matched everything, `a_b` matched `axb`). Not
injection — terms are bound — but a search-correctness bug across every
user-facing ILIKE site.

- repo::escape_like: shared pub(crate) escaper (promoted from page_tag), unit-tested.
- Trigram-entangled sites (manga, tag, author) append a separate escaped param
  used only by the ILIKE branch; the trigram/similarity branches keep the raw term.
- Pattern-built sites (admin manga list, admin users, analysis coverage + history,
  crawler search incl. JSONB payload title) escape inside format!("%{}%", ..) and
  pair each ILIKE with ESCAPE '\'.

Tests: escape_like unit tests + integration tests on public manga search, author
autocomplete, and admin user search proving `_` matches literally.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/tests/api_admin_users.rs

@@ -147,6 +147,46 @@ async fn list_filters_by_substring_search(pool: PgPool) {
     assert_eq!(body["page"]["total"], 1);
 }
 
+#[sqlx::test(migrations = "./migrations")]
+async fn search_treats_like_wildcards_literally(pool: PgPool) {
+    let h = common::harness(pool.clone());
+    let (_admin_name, cookie, _) = seed_admin(&pool, &h.app).await;
+    // Two usernames differing only at one position (underscores are legal in
+    // usernames). `_` is a LIKE single-char wildcard: unescaped, `%a_b%` matches
+    // BOTH; escaped, only the literal "a_b" username. Admin user search has no
+    // trigram OR, so length/similarity don't matter here.
+    for username in ["axbfindme", "a_bfindme"] {
+        let resp = h
+            .app
+            .clone()
+            .oneshot(common::post_json(
+                "/api/v1/auth/register",
+                json!({ "username": username, "password": "hunter2hunter2" }),
+            ))
+            .await
+            .unwrap();
+        assert_eq!(resp.status(), StatusCode::CREATED);
+    }
+
+    let resp = h
+        .app
+        .oneshot(common::get_with_cookie(
+            "/api/v1/admin/users?search=a_b",
+            &cookie,
+        ))
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::OK);
+    let body = common::body_json(resp).await;
+    let items = body["items"].as_array().unwrap();
+    assert_eq!(
+        items.len(),
+        1,
+        "the `_` must match literally: only a_bfindme, not axbfindme"
+    );
+    assert_eq!(items[0]["username"], "a_bfindme");
+}
+
 // ---- self-protection -------------------------------------------------------
 
 #[sqlx::test(migrations = "./migrations")]

backend/tests/api_authors.rs

@@ -30,6 +30,47 @@ fn first_author_id(manga: &Value) -> String {
     manga["authors"][0]["id"].as_str().unwrap().to_string()
 }
 
+#[sqlx::test(migrations = "./migrations")]
+async fn search_treats_like_wildcards_literally(pool: PgPool) {
+    let h = common::harness(pool);
+    let (_, cookie) = common::register_user(&h.app).await;
+    // Long author names differing only at one position, short search term — so
+    // the trigram OR (which keeps the raw term by design) stays under threshold
+    // and the ILIKE branch is what decides. Unescaped `%a_b%` matches both the
+    // "axb" and "a_b" names; escaped, only the literal "a_b" name.
+    create_manga(
+        &h.app,
+        &cookie,
+        json!({ "title": "M1", "authors": ["The Quick Brown Fox axb Jumps Over"] }),
+    )
+    .await;
+    create_manga(
+        &h.app,
+        &cookie,
+        json!({ "title": "M2", "authors": ["The Quick Brown Fox a_b Jumps Over"] }),
+    )
+    .await;
+
+    let resp = h
+        .app
+        .oneshot(common::get("/api/v1/authors?search=a_b"))
+        .await
+        .unwrap();
+    assert_eq!(resp.status(), StatusCode::OK);
+    let body = common::body_json(resp).await;
+    let names: Vec<&str> = body
+        .as_array()
+        .unwrap()
+        .iter()
+        .map(|a| a["name"].as_str().unwrap())
+        .collect();
+    assert_eq!(
+        names,
+        vec!["The Quick Brown Fox a_b Jumps Over"],
+        "the `_` in the search term must match literally, not as a wildcard"
+    );
+}
+
 #[sqlx::test(migrations = "./migrations")]
 async fn get_returns_name_and_manga_count(pool: PgPool) {
     let h = common::harness(pool);

backend/tests/api_mangas.rs

@@ -135,6 +135,30 @@ async fn list_total_is_computed_only_on_the_first_page(pool: PgPool) {
     assert_eq!(body1["items"].as_array().unwrap().len(), 1);
 }
 
+#[sqlx::test(migrations = "./migrations")]
+async fn search_treats_like_wildcards_literally(pool: PgPool) {
+    let h = common::harness(pool);
+    let (_, cookie) = common::register_user(&h.app).await;
+    // Two long titles differing only at one position. `_` is a LIKE single-char
+    // wildcard: unescaped, `%a_b%` matches BOTH ("axb" and "a_b"); escaped, only
+    // the literal "a_b" title matches. The titles are long and the term short so
+    // trigram similarity stays under threshold — the ILIKE branch decides.
+    seed(&h.app, &cookie, "The Quick Brown Fox Jumps axb Over The Lazy Dog").await;
+    seed(&h.app, &cookie, "The Quick Brown Fox Jumps a_b Over The Lazy Dog").await;
+
+    let resp = h
+        .app
+        .oneshot(common::get("/api/v1/mangas?search=a_b"))
+        .await
+        .unwrap();
+    let body = common::body_json(resp).await;
+    assert_eq!(
+        title_list(&body),
+        vec!["The Quick Brown Fox Jumps a_b Over The Lazy Dog"],
+        "the `_` in the search term must match literally, not as a wildcard"
+    );
+}
+
 #[sqlx::test(migrations = "./migrations")]
 async fn search_via_trigram_tolerates_typos(pool: PgPool) {
     let h = common::harness(pool);