Fix SQL injection, query value handling, and other security issues

- Quote all identifiers and validate operators, order strategies, join
  types, raw comparisons, and limit/offset/page in the query generator
- Treat 0 as a real query value; stop null from leaving unbound
  placeholders
- Return the WHERE clause and its values separately from sqlGenerator so
  delete/update no longer regex-parse generated SQL
- update(): target matched row ids, re-fetch reliably, and return
  success: false when no rows match
- Fix duplicated aliases, [object Object] select fields, AVERAGE -> AVG,
  escape GROUP_CONCAT separators
- Fix OFFSET without LIMIT and OFFSET on count queries
- Store boolean false as 0 on insert; call function values once
- Verify TLS certificates by default (new ssl_reject_unauthorized option)
- Confirm before importing an executable schema from an archive (--yes)
- Skip symlinks when reading extracted zip archives
- Only trim files matching the backup/export naming pattern
- Tighten default HTML sanitizer (no style/id attributes, no button)
- Stop typedef generation from mutating parent table schemas
- Pass config through DbSQL; handle BigInt values in results

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/lib/db-handler.ts

@@ -54,7 +54,15 @@ export default async function dbHandler<
 
         const res_array = (() => {
             try {
-                return JSON.parse(JSON.stringify(res)) as T[];
+                return JSON.parse(
+                    JSON.stringify(res, (_key, value) =>
+                        typeof value == "bigint"
+                            ? Number.isSafeInteger(Number(value))
+                                ? Number(value)
+                                : value.toString()
+                            : value,
+                    ),
+                ) as T[];
             } catch (error) {
                 return undefined;
             }