REST `where` on a localized field 500s when `localization.fallback: false` and no `?locale=` is sent (`req.locale` is null, `validateSearchParams` reads `.length`)

Describe the Bug

With localization.fallback: false, a REST query that filters on a localized field without an explicit ?locale= returns a 500:

TypeError: Cannot read properties of null (reading 'length')
    at validateSearchParams (dist/database/queryValidation/validateSearchParams.js:102)

Root cause: sanitizeLocales (dist/utilities/addLocalesToRequest.js) only substitutes localization.defaultLocale when localization.fallback is truthy:

} else if (localization && !localization.localeCodes.includes(locale) && localization.fallback) {
    locale = localization.defaultLocale;
}

So with fallback: false and no locale in the request, req.locale stays null. getLocalizedPaths then builds the path slug.null, and validateSearchParams does req.locale.length on null.

Unaffected: ?locale=de, ?locale=all, and where on non-localized fields. Still present in 3.89.0 (both files unchanged vs 3.88.0).

Link to the code that reproduces this issue

Minimal config (no external repo needed):

localization: {
  locales: ['de', 'en'],
  defaultLocale: 'de',
  fallback: false,
},
collections: [{
  slug: 'pages',
  fields: [{ name: 'slug', type: 'text', localized: true }],
}],

Reproduction Steps

1. Use the config above, create one page.
2. GET /api/pages?where[slug][equals]=x → 500 with the TypeError above.
3. GET /api/pages?where[slug][equals]=x&locale=de → 200.
4. GET /api/pages?where[id][equals]=1 → 200 (non-localized field).

Expected: with no ?locale=, the request should use defaultLocale (as it does when fallback: true), or at minimum return a 400 instead of crashing.

Which area(s) are affected? (Select all that apply)

area: core

Environment Info

payload: 3.88.0 (source unchanged in 3.89.0)
next: 16.3.4
node: 22
db: @payloadcms/db-postgres (also reproduces on db-sqlite)