fix(search): split dotted tokens in FTS5 queries so version strings match; fix HTTP API path prefix

[tobi]

Fixes #563, fixes #576

Bug 1: FTS5 doesn't match dotted version strings (#563)

Root cause: sanitizeFTS5Term strips all non-alphanumeric chars including dots, so 2026.4.10 becomes 2026410 — which never matches the indexed tokens 2026, 4, 10 (the unicode61 tokenizer splits on dots).

Fix: Added isDottedToken() + sanitizeDottedTerm() helpers (mirrors the existing hyphen-splitting logic). When a search term looks like a dotted version string, it's split on dots and the parts are AND'd: 2026.4.10 → "2026"* AND "4"* AND "10"*.

Bug 2: HTTP API returns paths without qmd:// prefix (#576)

Root cause: The REST /query endpoint returned r.displayPath (collection/path) directly, while the CLI returns qmd://collection/path. The encodeQmdPath() helper existed but wasn't applied to the REST response.

Fix: One-liner — wrap displayPath with encodeQmdPath() in the REST handler so HTTP API output matches CLI output.

Tests

• test/store.test.ts: regression test for searchFTS("2026.4.10") finding a doc that contains the string
• test/mcp.test.ts: asserts every file field in REST query results starts with qmd://