Case-insensitive substring search over the global cities catalog.
Useful to resolve a human-readable location into a numeric city_id
before creating an offline or mixed event.

Each result is preloaded with its region and country to avoid
N+1 queries on the caller side.

Behavior:

• Matches name LIKE "%q%" (substring, case-insensitive in MySQL utf8_general_ci).
• Wildcards % and _ in q are escaped — no client-side wildcard matching.
• Optional country_iso_code narrows results to a single country (case-insensitive).
• Results are ordered by name ASC.
• Capped at 20 results (no pagination — refine the query instead).
• Response is cacheable for 30 minutes (Cache-Control: public, max-age=1800).

Rate limit: 100 requests/minute per IP (600 for whitelisted IPs).