search() passes limit/candidates into SQL with no guard

[royalpinto007]

Problem

search() passes limit/candidates straight into SQL with no guard. Only the /ask body validates; evaluate.run_case and direct callers do not.

Where

vaultrag/retrieval.py (limit: int = 5, candidates: int = 50, interpolated into LIMIT).

Acceptance

Add a failing test first asserting search() with limit=0/-1 or candidates=-1 raises ValueError before SQL. Then fix.

[Rudra-G-23]

I'd like to work on this issue.

[github-actions]

It's yours, @Rudra-G-23. Marked this as claimed.

Take your time, and shout in this thread if you get stuck. If there's no activity for 14 days the claim is released so someone else can pick it up.

[Rudra-G-23]

PR raised #30