fix(security): tighten overlappingAlt detector to catch (a|aa)+ patterns

The previous regex required a second quantifier after the group quantifier,
so patterns like (a|aa)+$ could bypass the ReDoS check. Remove the trailing
quantifier requirement so any quantified alternation group is flagged.

Addresses coderabbitai review comment on PR wonderwhy-er#400.

https://claude.ai/code/session_01UesrAy2NYmCpw7rqX71V5X

Author: sorlen008

src/search-manager.ts

@@ -21,9 +21,9 @@ export function isSafeRegex(pattern: string): boolean {
     return false;
   }
 
-  // Detect overlapping alternations in quantified groups: (a|a)+, (\w|\d)+
-  // These can also cause catastrophic backtracking
-  const overlappingAlt = /\((?:[^)]*\|[^)]*)\)[+*]\s*[+*?{]/;
+  // Detect overlapping alternations in quantified groups: (a|a)+, (a|aa)+, (\w|\d)+
+  // These can cause catastrophic backtracking even without a second outer quantifier
+  const overlappingAlt = /\((?:[^)]*\|[^)]*)\)[+*]/;
   if (overlappingAlt.test(pattern)) {
     return false;
   }