* fix: allowlist resource_type and escape search highlights
* fix: bound path length and keep marked-label offsets entity-aware
* fix: match postgres word-char semantics and drop double-escaping
* fix: sanitize db constraint and rls errors instead of relying on the regex
