fix(api): escape ilike wildcards in admin list-query q params

Summary

GET /admin/events?q= and GET /admin/announcements?q= pass raw user input into Drizzle's ilike(table.name, \%${q}%`). Postgres %and_ characters in the search string act as wildcards inside the pattern, so a search for \50% off` matches anything containing "50" then any 0+ chars then " off" — too broad.

Requirements

• Pre-escape %, _, and \\ in the raw q before pattern interpolation
• Apply to both packages/api/src/routes/admin/events/index.ts and packages/api/src/routes/admin/announcements/index.ts
• Add a unit test asserting % inside q is treated literally

Context

Surfaced in the Plan 3 review (PR #1999). Plan 4 (forms) and Plan 5 (broadcast) will add more ilike filters; fix once before they land so the new code can copy the right pattern.

Implementation Notes

A small helper such as escapeIlike(s: string) in packages/api/src/lib/sql.ts (new file) keeps this consistent across routes.

Start with the q handling in packages/api/src/routes/admin/events/index.ts and packages/api/src/routes/admin/announcements/index.ts, then review the proposed shared helper in packages/api/src/lib/sql.ts. Escape %, _, and backslashes before interpolation, add a unit test covering a literal % in q, and verify both admin list queries treat these characters literally.