Case-insensitive exact match. Plain fields are scanned; protected
fields need crate::schema::FieldIndex::Exact declared (the
lowercased token digest is looked up — no false positives).
Case-insensitive prefix match. Plain fields are scanned; protected
fields need crate::schema::FieldIndex::Prefix covering the probe
length (prefix tokens are exact — no false positives).
LIKE-style substring match. Works on plain fields (in-memory scan) and
on RSA fields (values are decrypted with the private key and cached
per immutable version, so each value is decrypted at most once per
process). One-way hashed fields (Sha256/Hmac) cannot be
substring-scanned — the plaintext is never stored — unless they
declare crate::schema::FieldIndex::Ngram, which matches candidate
digests instead (case-insensitive, may include false positives). An
Ngram index also narrows RSA fields to candidates before decryption.