- schema.sql: avatar_cid → avatar_url to match production
- sanitize(): use unicode-aware \p{L}\p{N} instead of ASCII-only \w
- return 400 for empty query and limit>100 to match Bluesky's behavior

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

KV key "backfill" = "off" disables without redeploy. global rate
limit (10/min) caps total backfill writes regardless of user count.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

the /request-indexing endpoint interpolated user input and slingshot
response data directly into html. added escHtml() for entity encoding.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>