feat(11-02): wire Region/PLZ/Bundesland filter into query builder + FilterPanel

TenderQueryDto gains validated plz (@MaxLength(5)), region, and
bundesland fields. buildTenderWhere adds three conditional AND-branches:
plz startsWith, bundesland exact-match against the now-backfilled indexed
column (Pitfall 1), and region startsWith (usable independent of the
bundesland column). FilterPanel gets a PLZ input and a 16-Land Bundesland
dropdown (mirrors NUTS1_BUNDESLAND — web/api are separate packages) that
write plz/bundesland into the URL searchParams; ResultsList already
forwards the full URLSearchParams to listTenders(), so no additional
fetch wiring was needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/api/src/tenders/dto/tender-query.dto.ts

@@ -24,8 +24,8 @@ import {
  *
  * Used for: GET /modules/tender-radar?page=1&limit=20&status=active&q=...
  *
- * Region/PLZ/Bundesland/CPV/favOnly filters are added in later Phase-11
- * plans (11-02/03/05) — deliberately NOT added here.
+ * CPV/favOnly filters are added in later Phase-11 plans (11-03/05) —
+ * deliberately NOT added here.
  */
 export class TenderQueryDto {
   /**
@@ -121,4 +121,31 @@ export class TenderQueryDto {
   @IsOptional()
   @IsIn(['deadline', 'value', 'published'])
   sort?: string;
+
+  /**
+   * PLZ-Präfixfilter (FILTER-02, D-02). MaxLength(5) — German postal codes
+   * are 5 digits; a startsWith match still permits shorter prefixes.
+   */
+  @IsOptional()
+  @IsString()
+  @MaxLength(5)
+  plz?: string;
+
+  /**
+   * NUTS-Region-Präfixfilter (FILTER-02, D-02) — matched via
+   * `region: { startsWith: ... }` in the builder.
+   */
+  @IsOptional()
+  @IsString()
+  region?: string;
+
+  /**
+   * Bundesland-Name-Filter (FILTER-02, D-02, Pitfall 1). Matched against
+   * the backfilled/normalizer-derived `bundesland` column
+   * (@@index([bundesland])) — real hits only after the
+   * 20260721140000_tender_bundesland_backfill migration.
+   */
+  @IsOptional()
+  @IsString()
+  bundesland?: string;
 }