Explore Search

Corpus-wide place search (CORPUS_SEARCH_DESIGN.md §4.2). lat/lng bias to a ~50km box with auto-widen.

Open to every signed-in user as of the gate lift (it was get_admin_user while the Saved tab's search footer was dogfooded). mode and preview stayed admin-only affordances, so rather than exposing them to the wider audience they are coerced back to their product defaults for non-admins:

• mode is the admin preview's eval toggle. semantic/hybrid embed the query per request, so leaving it open would let any caller spend embedding budget; the user-facing product is bm25 regardless (design doc §6).
• preview marks a serve for the training-exclusion hygiene contract. Honouring it from arbitrary callers would let real user searches opt themselves out of training data.

Coerced rather than 400'd: both are absent from the shipping clients' query strings (getExploreSearch sends q/limit/sid only), so a request carrying them is a hand-rolled one, not a client that needs an error.