fix(web): use locale-independent lowercase in search matching

[dylantirandaz]

What this changes

Case-insensitive search in the web app used String.prototype.toLocaleLowerCase(), which is locale-sensitive. Under Turkish/Azeri locales, 'IMAGE'.toLocaleLowerCase() produces 'ımage' (dotless ı), so an uppercase ASCII query silently fails to match lowercase text.

This replaces toLocaleLowerCase() with the locale-independent toLowerCase() at all seven search-matching call sites:

• apps/web/src/features/transcript-search/model.ts (plainTextHighlightSegments)
• apps/web/src/features/transcript-search/fixtures.ts (fixture search matching)
• apps/web/src/lib/session-tree.ts (rail session search)
• apps/web/src/features/settings/SettingsWorkspace.tsx (settings search)

A repo-wide grep confirms these are the only toLocaleLowerCase() occurrences, so none were left behind. Also updates the reference-only provenance checksum for apps/web/src/lib/session-tree.ts (required by check-provenance).

Regression tests in apps/web/test/transcript-search.test.tsx and apps/web/test/session-tree.test.ts stub String.prototype.toLocaleLowerCase to simulate a Turkish locale (I → ı, restored in afterEach) and assert that uppercase queries (IMAGE, PAGINATION) still match lowercase text.

Verification

• pnpm --filter @t4-code/web test — 71 files, 997 tests, all pass.
• Pre-fix proof: stashed only the four source files and re-ran the two touched test files — exactly the two new tests failed (transcript search model > matches uppercase ASCII queries under a Turkish locale and buildProjectGroups > matches uppercase ASCII queries under a Turkish locale); restored the fix and both pass.
• pnpm check passes (release consistency, provenance 0 failures, lint --deny-warnings, typecheck).
• Full pnpm test: the only failure is the pre-existing packages/client test/transcript-retention.test.ts ("keeps the newest contiguous suffix under count, entry, and cumulative bytes"), which also fails on unmodified main and is unrelated to this PR.

Checklist

• pnpm check passes (release contract, provenance, lint, typecheck)
• pnpm test passes; new behavior has a test that fails without this change
• Any pasted logs or screenshots are redacted: no secrets, tokens, pairing codes, or private paths
• Ported code (T3 Code / OMP) follows the provenance rules in THIRD_PARTY_NOTICES.md