Public place search using the same candidate-confirmation contract.

This is the canonical system entry point for turning user text into candidate locations. Callers must still use/confirm one returned candidate; never silently pick an ambiguous city.

Transport: a place-search response carries up to 10 candidates × ~16 fields each (~2.5–3 KB), and the dashboard birth-place autocomplete fires it per-keystroke during onboarding, so the response is gzip-negotiated via the audited _json_response_maybe_gzip helper. The DECOMPRESSED body is byte-identical to the old return _with_meta(...) path (no contract, field, or value change), and clients that do not advertise Accept-Encoding: gzip (or tiny payloads) get the unchanged JSON body. Same proven transport-only pattern as #460/#461/#462/#463/#469/#470.