fix(mcp): default whereLanguage to lucene when creating a saved search (#3404)

## Summary

`clickstack_save_saved_search` stores a new saved search without `whereLanguage` when the caller omits it. The app reads a missing value as Lucene, but alerts read it as SQL (`buildSearchChartConfig` falls back to `'sql'`). So a Lucene filter such as `level:error` looks fine in the search page while the search's alerts evaluate it as SQL and break. Found by @pulpdrew in review of #3396.

- On create, an omitted `whereLanguage` is now stored as `lucene`, which matches the app and the tool's description.
- On update, an omitted `whereLanguage` still keeps the stored value. A schema-level `.default('lucene')` would have overwritten a stored `sql` value on every update that left the field out, so the default lives on the create path only.

Stacked on #3396, which kept its changes to descriptions only.

### How to reproduce

**Starting point:** local `yarn dev`, with an MCP client connected (see `MCP.md`).

**On `main`:**

1. Call `clickstack_save_saved_search` with a `name`, a `sourceId`, and `where: "level:error"`, and no `whereLanguage`.
2. Call `clickstack_get_saved_search` with the returned id. `whereLanguage` is missing.

**On this branch:**

1. Repeat the steps above. `whereLanguage` is `lucene`.
2. Update the same search with `whereLanguage: "sql"`, then update it again without `whereLanguage`. It stays `sql`.

`packages/api/src/mcp/__tests__/savedSearches.int.test.ts` covers both cases.

### References

- Related PRs: #3396 (base)

Author: brandon-pereira

.changeset/mcp-saved-search-where-language.md

@@ -0,0 +1,5 @@
+---
+'@hyperdx/api': patch
+---
+
+fix(mcp): store whereLanguage as lucene when clickstack_save_saved_search creates a search without one, so its alerts no longer parse a Lucene filter as SQL

packages/api/src/mcp/__tests__/savedSearches.int.test.ts

@@ -239,6 +239,7 @@ describe('MCP Saved Search Tools', () => {
         expect(output.where).toBe('');
         expect(output.select).toBe('');
         expect(output.tags).toEqual([]);
+        expect(output.whereLanguage).toBe('lucene');
       });
 
       it('should create a saved search with SQL where language', async () => {
@@ -378,6 +379,24 @@ describe('MCP Saved Search Tools', () => {
         expect(updated?.where).toBe('StatusCode:Ok');
       });
 
+      it('should keep the stored whereLanguage when an update omits it', async () => {
+        const savedSearch = await createTestSavedSearch({
+          where: "StatusCode = 'Error'",
+          whereLanguage: 'sql',
+        });
+
+        const result = await callTool(client, 'clickstack_save_saved_search', {
+          id: savedSearch._id.toString(),
+          name: 'Renamed',
+          sourceId: traceSource._id.toString(),
+          where: "StatusCode = 'Ok'",
+        });
+
+        expect(result.isError).toBeFalsy();
+        const updated = await SavedSearch.findById(savedSearch._id);
+        expect(updated?.whereLanguage).toBe('sql');
+      });
+
       it('should return error for non-existent saved search on update', async () => {
         const fakeId = '000000000000000000000000';
         const result = await callTool(client, 'clickstack_save_saved_search', {

packages/api/src/mcp/tools/savedSearches/saveSavedSearch.ts

@@ -60,7 +60,9 @@ export function registerSaveSavedSearch({
         name: input.name,
         select: input.select ?? '',
         where: input.where ?? '',
-        whereLanguage: input.whereLanguage,
+        // Alerts read a missing whereLanguage as sql while the app reads it as
+        // lucene, so a new search must store it explicitly.
+        whereLanguage: input.whereLanguage ?? (isUpdate ? undefined : 'lucene'),
         orderBy: input.orderBy,
         source: input.sourceId,
         tags: input.tags ?? [],