refactor: centralize search validation and runtime controls

[afoote-mitre]

Stack

3 of 6 in the 0.4.0 review stack.

• Base: af/0.4.0-review-02-runtime
• Previous: #123
• Next: #125

Why These Changes Are Needed

The application still had legacy search fallbacks and configuration reads spread across request paths. Semantic CPE processing also needed incremental validation so one malformed or incompatible candidate could not contaminate later applicability decisions. This range centralizes those responsibilities and adds explicit application-level resource controls.

Review Size

Changed lines are additions plus deletions in this PR's adjacent diff. Generated files are package-lock.json and api-docs/openapi.json; tests are *.test.js and files under test/.

Category	Changed Lines
Total	2,981
Generated files	6
Tests	1,371
Non-generated, non-test	1,604

Change-to-File Map

Change	Why It Is Needed	Primary Implementation Files	Test / Contract Coverage
Remove legacy search fallbacks	Ensure dependency and construction failures cannot fall through to stale behavior or partial results.	controllers/searchController.js, utils/searchProvider.js, utils/searchQueryBuilder.js	Corresponding controller/provider/query-builder test suites
Validate semantic candidates incrementally	Isolate candidate retrieval and reject malformed candidate structures before CPE applicability evaluation.	utils/searchCandidateProcessor.js, utils/searchResponseValidator.js, controllers/searchController.js	utils/searchCandidateProcessor.test.js, controllers/searchController.test.js
Tighten CVE and virtual-match parsing	Canonicalize CVE IDs and reject malformed or ambiguous virtualMatchString inputs before querying.	utils/cveId.js, controllers/middleware.js, utils/cpe.js, utils/searchQueryBuilder.js	utils/cveId.test.js, controllers/middleware.test.js, utils/cpe.test.js, utils/searchQueryBuilder.test.js
Enforce same-entry CPE applicability	Prevent components or ranges from separate cpeMatch entries from combining into a false match.	utils/cpe.js, utils/searchCandidateProcessor.js, controllers/searchController.js	utils/cpe.test.js, utils/searchCandidateProcessor.test.js, controllers/searchController.test.js
Centralize runtime configuration	Resolve, normalize, and validate environment/config values once for server, OpenSearch, logging, and feature behavior.	utils/runtimeConfig.js, utils/featureFlags.js, utils/requestLogging.js, utils/searchProvider.js, server.js, config/*.jsonc	Matching utility tests, server.test.js, config/runtime-config.test.js
Add application resource controls	Bound request rates, search work, body/string lengths, and dependency time while preserving standard-search total semantics.	utils/searchRateLimiter.js, utils/constants.js, utils/searchDeadline.js, routes/index.js, server.js	utils/searchRateLimiter.test.js, route/server/middleware/controller tests
Harden container/runtime packaging	Keep local and production images aligned with validated configuration and runtime ownership.	Dockerfile, Dockerfile.local, .env.example	config/runtime-config.test.js
Align public documentation	Document centralized configuration, resource controls, CVE/CPE validation, and bounded semantic behavior.	README.md, routes/swagger.js, api-docs/openapi.json	api-docs/openapi.test.js

Reviewer Focus

• Confirm configuration is resolved and validated once rather than mixed with request logic.
• Verify candidate validation and CPE component checks stay within one cpeMatch entry.
• Review rate-limit, body, candidate, and timeout defaults and their environment overrides.
• Confirm legacy fallback removal cannot turn dependency errors into partial success.