feat(04-01): curated KL gazetteer + lazy three-environment loader + GPL/ODbL licensing

- kl-gazetteer.json: 30 hand-curated KL-metro landmarks (10 required + 20
  more) with locals' aliases as native data (D-08) — canonical OSM names
  as name, shorthand ('KLCC', 'DUKE', 'Sg Wang') as aliases — plus the
  ODbL-1.0 attribution header traveling inside the JSON (D-06/D-07)
- gazetteer.ts: the three laws — lazy memoized index never at module
  scope (Workers startup, T-04-04), static JSON import surviving
  wrangler/Vite/bare-Node (D-07), zero logging/storage (D-15); aliases
  normalized once at index-build (D-09 symmetry)
- source.ts: the D-03 SearchSource — async search() + synchronous byId()
  (slug-validated, honest null); tiered admission (fuzzy only at sim
  >= 0.72) so 'Kuching'/'Penang' refuse as [] — never a fabricated pin
- index.ts: the named-export public API (no default, subpath+extension
  imports per the @araharah/theme precedent)
- LICENSE: the verbatim GPL-3.0 text (D-04); LICENSES.md: the dual-licence
  note (code GPL-3.0, data ODbL-1.0 + OSM attribution); README: corrected
  licence section + search/ in the layout, four-package table, commands

G1-G11 + L1-L3 green (39/39); typecheck clean; esbuild bundle carries the
suria-klcc marker; wrangler dry-run exits 0; bot + web suites unaffected.

README.md

@@ -14,13 +14,14 @@ The Telegram bot is **arah2bot**.
 
 ## Overview
 
-arah² is an npm-workspaces monorepo with three packages:
+arah² is an npm-workspaces monorepo with four packages:
 
 | Package | Name | What it does |
 |---|---|---|
 | `theme/` | `@araharah/theme` | The Telemetry Rams design system as a Tailwind v4 CSS-first token package. Every color, spacing, type, and radius value in the project is defined once in `theme/src/tokens.css` and compiled to `theme/dist/rams.css`. Also ships the MapLibre basemap style `theme/basemap/liberty-rams.json` plus gallery/audit/screenshot tooling. |
 | `bot/` | `@araharah/bot` | A [grammY](https://grammy.dev) Telegram bot running on a Cloudflare Worker. It serves the `/telegram/webhook` route, four JSON API routes, keeps TTL-only chat sessions in Workers KV, and serves the Mini App's static assets through a wrangler assets binding. |
 | `web/` | `@araharah/web` | The Telegram Mini App: a MapLibre GL navigation shell built with Vite. Owns the three-source location acquisition chain, an in-memory session store, and the Telegram WebApp integrations (theme slots, BackButton, safe-area insets). |
+| `search/` | `@araharah/search` | The shared, dependency-free destination-search module: the JUPEM-derived Malay abbreviation table as editable data, a symmetric normalizer, a Damerau (OSA) residual scorer with disjoint tiers, and the curated KL gazetteer with locals' aliases — imported by the bot, the Mini App, and the search-quality corpus runner. |
 
 The Worker is the single origin. It answers `/api/*` and `/telegram/*` itself (`run_worker_first`) and serves everything else out of `web/dist`.
 
@@ -188,8 +189,8 @@ Run from the repo root, or with `-w <workspace>`.
 | `npm run build` | Build the theme, then the Mini App |
 | `npm run dev` | Build, then run the Worker locally on port `8787` |
 | `npm run deploy` | Build, then `wrangler deploy` + `set-webhook.mjs` |
-| `npm run bot:test` / `npm run web:test` | Run each package's zero-dependency test suite |
-| `npm run bot:typecheck` / `npm run web:typecheck` | `tsc --noEmit` |
+| `npm run bot:test` / `npm run web:test` / `npm run search:test` | Run each package's zero-dependency test suite |
+| `npm run bot:typecheck` / `npm run web:typecheck` / `npm run search:typecheck` | `tsc --noEmit` |
 | `npm run bot:commands` | Register the persistent Telegram command menu (EN + MS) |
 | `npm run web:capture` | Capture Mini App screenshots |
 | `npm run web:build:harness` | Dual build into `dist-harness/` with the mock installer and fetch stubs |
@@ -214,12 +215,14 @@ Privacy is structural, not a policy page:
 theme/   @araharah/theme — tokens.css, components.css, theme.css, fonts/, basemap/, scripts/
 bot/     @araharah/bot   — src/webhook.ts entry, bot/, kv/, security/, i18n/, scripts/, wrangler.jsonc
 web/     @araharah/web   — src/main.ts entry, location/, map/, session/, telegram/, ui/, mock/
+search/  @araharah/search — src/types.ts, src/normalize.ts, src/score.ts, src/gazetteer.ts, src/data/kl-gazetteer.json
 stitch_minimalist_route_navigator/  read-only mockup screens (class-vocabulary source for the theme build)
 DESIGN.md  Rams philosophy — superseded for any specific value
 ```
 
 ## License
 
-Private repository. No license file is present; all rights reserved by the project owner.
-
-<!-- VERIFY: repository licensing — no `LICENSE` file exists in the working tree, and the project is marked `private: true` in `package.json`. -->
+Code is licensed under **GPL-3.0** — the full text is in [LICENSE](./LICENSE). The curated KL
+gazetteer (`search/src/data/kl-gazetteer.json`) is **data**, licensed separately under the Open
+Database License (ODbL) v1.0 with attribution to © OpenStreetMap contributors; the dual-licence
+note and the share-alike scope are in [LICENSES.md](./LICENSES.md).