improve query parser & enforce front-/back-end separation

The query parser now support the format [HASH_ALGO:]HEX_CHECKSUM, with
checks on the checksum length (if the algo is given) and guesses of the
algo when missing.

The front-end and back-end of the search service are now more separated,
with service only returning a boolean about the result, and raising an
exception in case of query string parse errors. It is up to the
controller/template to emit an error message if needed. This allows to
plug into the backend a proper front-facing API.

In passing, the templates have been migrated to valid (X)HTML --- not
validated though.