Fix SQL injection, query value handling, and other security issues

- Quote all identifiers and validate operators, order strategies, join
  types, raw comparisons, and limit/offset/page in the query generator
- Treat 0 as a real query value; stop null from leaving unbound
  placeholders
- Return the WHERE clause and its values separately from sqlGenerator so
  delete/update no longer regex-parse generated SQL
- update(): target matched row ids, re-fetch reliably, and return
  success: false when no rows match
- Fix duplicated aliases, [object Object] select fields, AVERAGE -> AVG,
  escape GROUP_CONCAT separators
- Fix OFFSET without LIMIT and OFFSET on count queries
- Store boolean false as 0 on insert; call function values once
- Verify TLS certificates by default (new ssl_reject_unauthorized option)
- Confirm before importing an executable schema from an archive (--yes)
- Skip symlinks when reading extracted zip archives
- Only trim files matching the backup/export naming pattern
- Tighten default HTML sanitizer (no style/id attributes, no button)
- Stop typedef generation from mutating parent table schemas
- Pass config through DbSQL; handle BigInt values in results

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/trim-exports.ts

@@ -1,5 +1,6 @@
 import fs from "fs";
 import path from "path";
+import _ from "lodash";
 import type { BunMariaDBConfig } from "../types";
 import { AppData } from "../data/app-data";
 import grabDBDir from "./grab-db-dir";
@@ -11,7 +12,16 @@ type Params = {
 
 export default function trimExports({ config }: Params) {
     const { export_dir } = grabDBDir({ config });
-    const exports = grabSortedExports({ config });
+    // Only consider archives written by `export` (`{db_name}-{timestamp}.tar.gz|zip`)
+    const exportNamePattern = new RegExp(
+        `^${_.escapeRegExp(config.db_name)}-\\d+\\.(tar\\.gz|zip)$`,
+    );
+
+    const exports = grabSortedExports({ config }).filter(
+        (name) =>
+            exportNamePattern.test(name) &&
+            fs.statSync(path.join(export_dir, name)).isFile(),
+    );
     const max_exports = config.max_exports || AppData["MaxExports"];
 
     for (let i = 0; i < exports.length; i++) {