feat: add user search

internal/server/server.go

@@ -475,12 +475,17 @@ func (s *Server) setupRouter() {
 			})
 		})
 
-		// User profile + avatar — all protected.
+		// User profile — mixed public-read + protected writes.
 		r.Route("/users", func(r chi.Router) {
 			if s.userH == nil {
 				r.HandleFunc("/*", s.authUnavailable)
 				return
 			}
+			// Public read — search by handle / name. Returns a
+			// sanitized payload (no email / role / plan / etc.).
+			r.Get("/search", s.userH.Search)
+			// Protected writes — profile edit, avatar presign,
+			// reading-prefs roaming.
 			r.Group(func(r chi.Router) {
 				r.Use(middleware.RequireAuth(s.authIssuer, s.userRepo))
 				r.Patch("/me", s.userH.UpdateProfile)