fix(search): harden authorized results and ordering

apps/web_v1/scripts/api-client.test.mjs

@@ -125,6 +125,19 @@ test('FormData body leaves Content-Type unset so fetch provides the boundary', a
   assert.equal(requestInit.headers['Content-Type'], undefined)
 })
 
+test('request forwards its AbortSignal to fetch', async () => {
+  let requestInit
+  const controller = new AbortController()
+  globalThis.fetch = async (_url, init) => {
+    requestInit = init
+    return Response.json({ ok: true })
+  }
+
+  await apiRequest('/search', { signal: controller.signal })
+
+  assert.equal(requestInit.signal, controller.signal)
+})
+
 test('base URL normalizer trims whitespace and all trailing slashes', () => {
   assert.equal(normalizeBaseUrl('  https://host.example///  '), 'https://host.example')
 })