feat: implement WooCommerce AJAX product search

shop/docs/TESTING.md

@@ -49,6 +49,20 @@
 | RTL/LTR/dark/mobile: zero `left/right`, logical props, `woo.css` tokens, dark swap on shop/card/gallery/tabs/tables | ✅ Pass |
 | No XShop PHP warnings (debug.log clean after 10 hits) / no JS console.log | ✅ Pass |
 
+### M3 Gate (AJAX Search) — manual QA performed 2026-09-13 (WP 7.1 / WC 11.1.0 / PHP 8.2.12)
+
+| Check | Result |
+|-------|--------|
+| `GET /wp-json/xshop/v1/search?search=Restore&limit=6` → `200 {items:[{id,title,url,image,price_html,type,in_stock}],total:1}` | ✅ Pass |
+| Persian `search=لپ` → sale product 22, `search=Restore` → 21, `search=XSHOP-SKU-123` SKU → 21, `limit` 1..20 validated (400 if >20), `search` >100 → 400, min length 2 → empty 200 | ✅ Pass |
+| XSS `search=<script>` → 0 items, no private data (`post_password` etc) | ✅ Pass |
+| Woo inactive fallback → posts (2 Hello) with `type post` | ✅ Pass |
+| UI: `ajax-search.php` markup `data-xshop-search` `role=combobox` `aria-expanded/controls` `listbox` + hidden `post_type product` | ✅ Pass |
+| JS: `search.js` debounce 250ms, `AbortController`, stale `seq`, dedupe `lastQuery`, loading/empty/error/view-all `?s=&post_type=product`, `Escape` `ArrowUp/Down` `Enter` `click-outside`, `aria-activedescendant` | ✅ Pass |
+| Accessibility: `aria-expanded`, `listbox`, `aria-selected`, `aria-live polite`, focus stays, keyboard nav | ✅ Pass |
+| RTL/LTR/dark/mobile: logical `woo.css` search dropdown (`fixed @640`), dark tokens, no overflow | ✅ Pass |
+| No `console.log` / `php -l` clean / `debug.log` clean | ✅ Pass |
+
 ## 3. Browser
 
 Chromium, Firefox, Edge, Safari (where available). Responsive: 360/768/1024/1280.