Sync fork main into upstream: Tap ingestion, advanced GraphQL queries, and frontend refresh - #42

SKILL.md references the stale env var `NEXT_PUBLIC_API_URL` at lines 101 and 106, but this PR renames it to `NEXT_PUBLIC_HYPERINDEX_URL` everywhere else (Dockerfile, env.ts, .env.example, docs/ENV_VARS.md). A developer following SKILL.md to deploy on Railway will set the wrong build arg, causing Next.js to silently fall back to `http://127.0.0.1:8080`, which breaks the production frontend.

The per-filter `MaxINListSize=100` cap does not protect against the aggregate parameter count when multiple IN filters are combined. With `MaxFilterConditions=20`, a worst-case query generates 20×100 + 4 fixed params = 2004 SQL parameters — more than double SQLite's hard `SQLITE_MAX_VARIABLE_NUMBER=999` limit stated in the code comments. Even a modest query with 10 fields each filtered by 100 IN values (1004 params) exceeds this limit. Neither `buildFilterClause` nor `GetByCollectionSortedWithKe

The API documentation states the search query minimum is 2 characters, but the code in `createSearchResolver()` enforces a minimum of 3 characters. Clients following the documented contract will receive unexpected errors for 2-character queries; fix by updating the docs to say "minimum 3 characters".