fix(search): bound the clinical kinds by the search budget, one search per actor, query in a POST body

docs/api/openapi.yaml

@@ -23729,7 +23729,7 @@ paths:
         "422": *a4
         "429": *a5
   /api/search:
-    get:
+    post:
       tags:
         - Records
       summary: Search the record
@@ -23738,30 +23738,31 @@ paths:
         notes on mood entries, readings and illness days. Hits are grouped by kind, the best group first, and each
         carries the in-app path that opens the record. Matching ignores case and accents and reads German umlauts typed
         as ae, oe, ue or ss. A source whose module the record has switched off is not read. The search reads each source
-        newest first under a per-source row cap and a time budget; `truncated` says when that cut it short. The query is
-        never logged. Rate limited per acting account (60 a minute). A grant scoped to some sections of the record does
-        not open it, like the timeline."
-      parameters:
-        - in: query
-          name: q
-          schema:
-            type: string
-            minLength: 2
-            maxLength: 100
-            description: What to look for. Matched without regard to case or accents, and German umlauts may be typed as ae, oe, ue
-              or ss.
-          required: true
-          description: What to look for. Matched without regard to case or accents, and German umlauts may be typed as ae, oe, ue
-            or ss.
-        - in: query
-          name: limit
-          schema:
-            default: 5
-            description: Most hits per group.
-            type: integer
-            minimum: 1
-            maximum: 20
-          description: Most hits per group.
+        newest first under a per-source row cap and a time budget; `truncated` says when that cut it short. The query
+        travels in the JSON body, never in the URL, and is never logged. Rate limited per acting account (20 a minute),
+        and one search at a time: a newer search by the same account stops the one before it, which then answers 409
+        `search.superseded`. A grant scoped to some sections of the record does not open it, like the timeline."
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                q:
+                  type: string
+                  minLength: 2
+                  maxLength: 100
+                  description: What to look for. Matched without regard to case or accents, and German umlauts may be typed as ae, oe, ue
+                    or ss.
+                limit:
+                  default: 5
+                  description: Most hits per group.
+                  type: integer
+                  minimum: 1
+                  maximum: 20
+              required:
+                - q
       responses:
         "200":
           description: The hits, grouped by kind.