`search_organisms` still substring-matches `taxonomicGroup` through `str(list)`

Part of #1733. Found in the review of #1732.

## Problem

`search_organisms` in `backend/api/app/services/catalog_data.py` (around line 118) matches current names with:

```python
q in str(org.get(field, "")).lower()
for field in ("taxonomicLevelSpecies", "taxonomicLevelGenus", "ncbiTaxonomyId",
"taxonomicGroup", "taxonomicLevelStrain", "taxonomicLevelIsolate")
```

`taxonomicGroup` is a list, so `str()` renders its Python repr and the query is substring-matched against `"['bacteria']"` — brackets, quotes and separators included.

This is the same defect #1732 just fixed one line below for `otherNames`, where the fix was an element-wise loop, and which the new `test_query_must_match_a_single_name` (`backend/tests/test_catalog_data.py:78`) asserts against. The one remaining list field was left on the old path.

## Failure scenario

Today it is latent rather than live: no organism in the current catalog carries more than one taxonomic group (0 of 1,975), so the repr of a one-element list happens to contain the group name and single-group queries work by accident. The moment any organism gets two groups, a query containing `', '` or `['` matches every such organism, and `"a', 'b"` style input matches on punctuation rather than on a name.

## Suggested fix

Apply the element-wise loop already written for `otherNames`: treat `taxonomicGroup` as a list and compare each element, leaving the scalar fields on the existing string comparison. Extend `test_query_must_match_a_single_name` to cover a two-group organism so the regression is pinned.