review: pin /api/search missing-q contract to 400 (#32)

CodeRabbit flagged that the permissive ``assert status_code in (200, 400)``
let either contract pass, so a drift between the two behaviours would go
unnoticed. The shipped implementation (api/search.py:74-75) returns
``400 with {"error": "No search query provided"}`` for missing or empty q.

Replaced the single permissive test with three concrete ones, each
asserting the same 400 + error-body contract:

  - test_missing_q_returns_400          — GET /api/search       (no q at all)
  - test_empty_q_returns_400            — GET /api/search?q=    (empty)
  - test_whitespace_only_q_returns_400  — GET /api/search?q=%20%20%20
                                          (api/search.py strips before checking)

191 pytest tests pass (was 189; +2 from the split).

Author: timon0305

tests/test_api_endpoints.py

@@ -109,11 +109,22 @@ def test_no_match_returns_empty_results(self, client):
         body = response.get_json()
         assert "results" in body and body["results"] == []
 
-    def test_missing_q_returns_400_or_empty(self, client):
+    def test_missing_q_returns_400(self, client):
         response = client.get("/api/search")
-        # Implementation may return 400 (missing required param) or 200 with empty.
-        # Both are reasonable for "no query supplied"; pin whichever shipped.
-        assert response.status_code in (200, 400)
-        if response.status_code == 200:
-            body = response.get_json()
-            assert "results" in body
+        assert response.status_code == 400
+        body = response.get_json()
+        assert "error" in body
+        assert body["error"] == "No search query provided"
+
+    def test_empty_q_returns_400(self, client):
+        response = client.get("/api/search?q=")
+        assert response.status_code == 400
+        body = response.get_json()
+        assert body.get("error") == "No search query provided"
+
+    def test_whitespace_only_q_returns_400(self, client):
+        # api/search.py strips q before the empty-check, so "   " is rejected.
+        response = client.get("/api/search?q=%20%20%20")
+        assert response.status_code == 400
+        body = response.get_json()
+        assert body.get("error") == "No search query provided"