Search a single dataset, returning brief rows + per-row unlock state. Dataset id comes from the URL — kind: predicates in the filter query param are rejected with 400 (the URL is authoritative). Empty filter is allowed (returns all rows of the dataset). To see the dataset's allowed filters and brief field shape, call /v1/datasets/:id.