feat(zetesis): andmatch row filter for Cardigann definitions

[forkwright]

Finding

search.rows.filters: andmatch is used by 65 of the 557 bundled Cardigann definitions and was rejected at load, taking every one of those trackers offline. It is the largest remaining rejected-at-load class in #513.

Evidence

• crates/zetesis/src/client/cardigann/definition.rs warned and ignored rows.filters, so 65 definitions either failed to load or silently returned unfiltered rows.
• Upstream semantics verified against Jackett/Prowlarr TorznabQuery.cs::MatchQueryStringAND and ParseRowFilters, not inferred.

Why this matters

Row filters are a separate dispatch from field filters: they decide whether a whole row survives, using the query keywords and the row title — state the field pipeline never sees. Without them, an andmatch tracker returns its entire unfiltered page as results.

Desired correction

Parse rows.filters into a RowFilter at the definition boundary and apply it between extraction and result mapping.

Done when: andmatch definitions load, rows lacking a query keyword are dropped, and the filter is skipped for natively-advertised ID searches.

---

Upstream fidelity

• Tokens split on non-word runs; single characters and stop-words and/the/an ignored.
• Case- and diacritic-insensitive (upstream compares with CompareOptions.IgnoreNonSpace).
• Skipped when the search is by an ID the definition advertises in caps.modes.
• andmatch: 0 means "do not truncate." Upstream guards with if (limit is > 0), so a 0 limit leaves the keywords whole and every one is still required. The character limit is Option<NonZeroUsize>, which makes the inverted reading — truncate to nothing, keep every row, filter silently disabled — unrepresentable rather than merely untested.

Review findings folded in

An adversarial review raised 8 findings; 4 survived refutation and are fixed here:

• andmatch: 0 semantics inverted vs upstream (above) — caught by reading the actual C# guard.
• ~700 Regex::new calls per 100-row page (measured 158ms release). Tokens are now built once per search instead of per row, and the two static patterns are LazyLock, matching the convention in ergasia/src/extract/rar.rs. The filter is now O(rows + tokens).
• Titleless rows were dropped with no diagnostic. Two bundled definitions (backups.yml, bestcore.yml) pair andmatch with title: optional: true. Such a row is now left for rows_to_results, which is where a titleless row is reported — dropping it here removed the only signal that a selector had stopped matching.
• The ID-skip branch had no test. Now covered.

Part of #513 — fuzzytime (22 defs), htmldecode (6), and the XML response type remain.