Fix TUI registry browser and harden search API

- TUI: Use list_tools for browsing (no query), search_tools only when
  user enters a search term. Fixes 500 error on initial registry load.

- API: Sanitize FTS5 queries by escaping special characters (* " ( ) etc)
  Prevents SQL errors from malformed search queries like "*"

Co-Authored-By: Claude Opus 4.5 <[email protected]>

src/cmdforge/registry/app.py

@@ -479,6 +479,15 @@ def create_app() -> Flask:
         query_text = request.args.get("q", "").strip()
         if not query_text:
             return error_response("VALIDATION_ERROR", "Missing search query")
+
+        # Sanitize query for FTS5 - escape special characters that cause syntax errors
+        # FTS5 special chars: * " ( ) : ^ - NOT AND OR NEAR
+        # For safety, we'll quote the entire query if it contains special chars
+        fts5_special = set('*"():^-')
+        if any(c in fts5_special for c in query_text) or query_text.upper() in ('NOT', 'AND', 'OR', 'NEAR'):
+            # Escape double quotes and wrap in quotes for literal search
+            query_text = '"' + query_text.replace('"', '""') + '"'
+
         page, per_page, sort, order, error = parse_pagination("/tools/search", "downloads")
         if error:
             return error