Potential regular expression denial of service (ReDoS)

`prefix` is controllable by the caller and could result in a regular expression denial of service (ReDoS).
* `api/routes/credentials.js`:
```
_id: {$regex: new RegExp('^' + prefix, 'i')}
```
* `api/routes/dictionary.js`:
```
_id: {$regex: new RegExp('^' + prefix, 'i')}
```

Start by reading the prefix handling in api/routes/credentials.js and api/routes/dictionary.js, then trace how the caller-controlled value reaches each RegExp construction. Done means both routes no longer allow a crafted prefix to cause regular expression denial of service; verify the behavior with the repository's relevant checks if available.

Written by the indexing model from the issue text.