Add tests, schema sync safeguards, and query/handler improvements

- Add bun test suite: SQL generator and value unit tests, plus MariaDB
  integration tests gated on BUN_MARIADB_TEST_DB
- schema: add --dry-run and require confirmation (or --yes) before
  dropping tables/columns; block unapproved destructive statements
- Always AND targetId with the query, regardless of searchOperator
- Initialize lazily on first call; init throws instead of exiting
- Generate IN (?, ?, ...) lists for IN / NOT IN
- Share value binding between insert and update (booleans, embeddings,
  function values, "" -> NULL for non-text columns)
- Keep Buffers and convert BigInt/Date without a JSON round-trip
- DbSQL: report success for empty SELECT results
- Run update() in a transaction with row locking
- Key the client cache on the full connection config
- Consolidate identifier quoting, drop dead code, merge column lookup
- Read CLI version from package.json, pin @types/bun, chmod CLI on compile
- Rebuild dist

Co-Authored-By: Claude Opus 5.5 <[email protected]>

dist/utils/sanitize-html-options.js

@@ -18,7 +18,6 @@ export const defaultSanitizeHtmlOptions = {
         "h6",
         "img",
         "div",
-        "button",
         "pre",
         "code",
         "br",
@@ -35,10 +34,12 @@ export const defaultSanitizeHtmlOptions = {
         "colgroup",
         "col",
     ],
+    // `style` / `id` are intentionally not allowed by default (CSS overlays,
+    // DOM clobbering). Add them via `html_sanitize.allowed_attributes`.
     allowedAttributes: {
-        a: ["href", "title", "class", "style", "target", "rel"],
-        img: ["src", "alt", "width", "height", "class", "style"],
-        "*": ["style", "class", "title", "id"],
+        a: ["href", "title", "class", "target", "rel"],
+        img: ["src", "alt", "width", "height", "class"],
+        "*": ["class", "title"],
     },
 };
 function uniqueStrings(values) {