m4.5: content-aware [[ linking — autocomplete searches note body

The [[ autocomplete only matched note names, so you could only link a
note you could name. Now it searches note NAME *and* body, so you can
link by recalling any phrase.

- new GET /api/notes/link-search?q= — owner-scoped, non-trashed;
  substring ILIKE on display_title OR body; ranked name-first, then
  name-prefix, then recency; empty q returns recent notes as
  suggestions. Deterministic (no semantic/AI search); the FTS index
  still powers the heavier /search. LIKE wildcards in q are escaped.
- editor [[ autocomplete now calls link-search (debounced 120ms)
  instead of filtering the cached titles index; excludes the note
  itself; inserts the matched note's display name as [[Name]].
- unit tests for the LIKE-escaping + a link-search auth guard.

Second item of M4.5; builds on the display_title work (every note has
a name to link to). Command-palette content search is a natural
follow-on, left out to keep this focused.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

src/thoughtsync/notes.py

@@ -6,7 +6,7 @@ import uuid
 from datetime import datetime, timezone
 
 from quart import Blueprint, g, jsonify, request, send_file
-from sqlalchemy import delete, func, literal_column, select
+from sqlalchemy import case, delete, func, literal_column, select
 
 from .acl import visible_to_user
 from .auth import login_required
@@ -281,6 +281,42 @@ async def list_titles():
         )
 
 
+def _escape_like(s: str) -> str:
+    """Escape LIKE wildcards so user input matches literally (escape char = \\)."""
+    return s.replace("\\", "\\\\").replace("%", "\\%").replace("_", "\\_")
+
+
+@bp.get("/link-search")
+@login_required
+async def link_search():
+    # Autocomplete source for [[wiki-links]]: match the query against a note's display
+    # NAME *or* its BODY, so you can link by recalling any phrase — not just the name.
+    # Substring ILIKE (good for partial-word typing, deterministic, fine at personal
+    # scale; the FTS index still powers the heavier /search). Name matches rank above
+    # body-only matches, and a name prefix above a mid-name substring. Empty q → recent.
+    q = (request.args.get("q") or "").strip()
+    async with session_scope() as db:
+        base = select(Note).where(
+            Note.owner_id == g.user_id, Note.deleted_at.is_(None), Note.display_title != ""
+        )
+        if not q:
+            stmt = base.order_by(Note.updated_at.desc()).limit(10)
+        else:
+            esc = _escape_like(q)
+            name_hit = Note.display_title.ilike(f"%{esc}%", escape="\\")
+            stmt = (
+                base.where(name_hit | Note.body.ilike(f"%{esc}%", escape="\\"))
+                .order_by(
+                    case((name_hit, 0), else_=1),
+                    case((Note.display_title.ilike(f"{esc}%", escape="\\"), 0), else_=1),
+                    Note.updated_at.desc(),
+                )
+                .limit(10)
+            )
+        rows = (await db.scalars(stmt)).all()
+        return jsonify({"results": [{"id": str(n.id), "title": n.display_title} for n in rows]})
+
+
 @bp.get("/<note_id>/backlinks")
 @login_required
 async def note_backlinks(note_id: str):