Audit follow-up: Page search can NPE when onlyLiveSites=true and host is unresolved

Parent epic: #36004

Finding

When onlyLiveSites=true, page search appears to call hosts.get(contentlet.getHost()).isLive() without checking whether the host lookup returned null.

Report reference: dotCMS/src/main/java/com/dotcms/rest/api/v1/page/PageResource.java:1288-1295

Potential impact

If a page/contentlet references a deleted, null, or otherwise unresolved host, the whole page-search picker may return 500 instead of excluding that page.

Suggested validation

Create or simulate a contentlet whose host cannot be resolved, then run page search with onlyLiveSites=true.

Possible fix

Null-check the host lookup and treat unresolved / non-live hosts as excluded, for example h != null && Try.of(h::isLive).getOrElse(false).

Caveat

This was AI-found by Claude from .scratch/audit/REPORT.md. Please perform secondary validation of correctness, severity, and value before actioning.

Start at dotCMS/src/main/java/com/dotcms/rest/api/v1/page/PageResource.java:1288-1295 and validate the reported host lookup behavior. Create or simulate a contentlet with an unresolved host, then run page search with onlyLiveSites=true. Done means unresolved or non-live hosts are excluded without the page-search picker returning a 500.