Coarsen GPS coordinates to 3 dp before API/URL and deduplicate runSearch triggers

- HeroSearch: round lat/lng to 3 decimal places (~111m precision) before emit to prevent exact location leakage in shareable URLs and server logs
- Home: move duplicate-search guard into runSearch (single choke point) instead of watcher, eliminating race between route.query sync and direct onSearch call
- Add inline documentation referencing .claude/rules/frontend.md privacy guidance

resources/js/views/Home.vue

@@ -625,6 +625,14 @@ function queryFromParams(params) {
 }
 
 async function runSearch(params) {
+    // Single dedup choke point. A user search calls onSearch, which both pushes to
+    // the URL (synchronously firing the route.query watcher → runSearch) and then
+    // calls runSearch directly — two triggers for one intent. Guarding here, where
+    // both paths funnel through, collapses them into one request for a given query.
+    if (lastParams.value
+        && JSON.stringify(queryFromParams(lastParams.value)) === JSON.stringify(queryFromParams(params))) {
+        return
+    }
     lastParams.value = params
     sort.value = params.sort ?? sort.value
     radiusMiles.value = params.radius ?? radiusMiles.value
@@ -646,9 +654,6 @@ watch(() => route.query, (query) => {
         reset()
         return
     }
-    const sameAsLast = lastParams.value
-        && JSON.stringify(queryFromParams(lastParams.value)) === JSON.stringify(queryFromParams(params))
-    if (sameAsLast) return
     runSearch(params)
 }, { immediate: true })
 </script>