fix(backend): expand saved search query length to 2048 and enforce AST node complexity guard (#2604)

[jcscottiii]

Summary

This PR resolves Issue #2604 by expanding the SavedSearch.query character length limit from 256 to 2048 characters across OpenAPI schemas, Go HTTP backend validation handlers, and Lit frontend components.

To permit users to bookmark long feature ID lists (e.g., 33+ feature IDs) while protecting Cloud Spanner against parameter exhaustion limits (950 max parameters) and query amplification attacks, this change introduces upstream AST deduplication and structural complexity validation.

---

What Was Changed

1. OpenAPI Schema Definitions (openapi/backend/openapi.yaml):

   • Updated SavedSearch.query maxLength: 2048 (was 256).
   • Updated SavedSearchUpdateRequest.query maxLength: 2048 and description maxLength: 1024.
   • Updated SavedSearchUpdateRequest.name maxLength: 32.
   • Regenerated Go and TypeScript OpenAPI types (make openapi).

2. Upstream Go Backend Validation (backend/pkg/httpserver & lib/backendtypes):

   • Updated savedSearchQueryMaxLength = 2048.
   • Defined const MaxASTNodes = 50 in lib/backendtypes/types.go.
   • Implemented AST deduplication (searchtypes.Deduplicate) and node complexity validation (CountNodes(dedupNode) <= 50) in CreateSavedSearch and UpdateSavedSearch.
   • Mapped backendtypes.ErrQueryComplexityExceeded to HTTP 400 Bad Request.

3. Spanner Adapter Expansion Safeguard (lib/gcpspanner/spanneradapters):

   • Enforced CountNodes(Deduplicate(expandedNode)) <= 50 in ValidateQueryReferences after recursive @saved-search resolution to prevent expansion amplification bypasses.

4. Frontend Constraints & Error Formatting (frontend/src/static/js):

   • Set QueryMaxLength: 2048 and DescriptionMaxLength: 1024 in webstatus-saved-search-editor.ts.
   • Enhanced frontend/src/static/js/api/errors.ts to format fieldErrorMap strings directly for Toast notifications.

5. Test Suite & Verification:

   • Added HTTP boundary test cases for 2048 length, 50 AST nodes, >50 AST nodes, and duplicate deduplication in create_saved_search_test.go and update_saved_search_test.go.
   • Added AST deduplication and nil safety unit tests in features_search_parse_test.go.
   • Added TestWorstCaseMaxComplexityQuerySpannerLimits in spanner_pipeline_analysis_test.go verifying that a worst-case 50-node query consumes only 27 / 950 parameters (2.84% of limit) and 5.7 KB / 1 MB SQL text (0.55% of limit).

---

Corrected Assumptions / Learnings

• AST Deduplication Unwrapping: When parsing left-associative binary AND/OR trees from ANTLR, deduplicating children leaves single-child Keyword nodes (A). Unwrapping single-child Keyword nodes (if node.IsKeyword() && len(children) == 1 { return children[0] }) collapses binary tree chains like (((A AND A) AND A) AND A) down to A.
• Expansion Complexity Validation: Upstream validation must run both on the unexpanded query string (in HTTP handlers) and after expandSavedSearches (in ValidateQueryReferences) to prevent nested @saved-search references from amplifying AST node complexity post-validation.

Fixes #2604

[jcscottiii]

This can wait until next week's release @neilv-g