Fix SQL injection, schema-sync data loss, and backup safety

Security:
- select: bind parameters instead of mysql.format (backslash escaping
  allowed injection on SQLite); drop the mysql dependency
- validate all interpolated identifiers, limit/offset/page, order
  strategy, operators, join types and raw equalities (new sql-safe.ts)
- quote identifiers and bind values in schema manager DDL/queries

Data loss:
- schema sync runs with foreign keys off inside a transaction, with
  foreign_key_check before commit (DROP TABLE no longer cascades)
- parentTableName tables: stop mutating the parent schema and copy
  inherited columns on rebuild
- keep column data on type changes (match columns by name)
- backups and schema snapshots use VACUUM INTO (includes WAL data);
  restore closes the DB, clears -wal/-shm, and swaps atomically
- backup listing/trimming only touches <db_name>-<timestamp> files

Correctness:
- update/delete use the generator's WHERE clause instead of a regex
- keep 0/""/false values; booleans stored as 0/1
- IN/NOT IN and BETWEEN arrays, NOT LIKE wrapping, AVG, select aliases
- OFFSET without LIMIT, count ignores pagination
- MATCH emits `field MATCH fn(?)` for sqlite-vec
- sql() returns rows for any row-producing statement
- targetId no longer mutates the caller's query
- init throws instead of process.exit; CLI reports errors

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/commands/backup.ts

@@ -2,10 +2,11 @@ import { Command } from "commander";
 import init from "../functions/init";
 import path from "path";
 import grabDBDir from "../utils/grab-db-dir";
-import fs from "fs";
 import grabDBBackupFileName from "../utils/grab-db-backup-file-name";
 import chalk from "chalk";
 import trimBackups from "../utils/trim-backups";
+import DbClient from "../lib/sqlite";
+import snapshotDb from "../utils/snapshot-db";
 
 export default function () {
     return new Command("backup")
@@ -15,11 +16,14 @@ export default function () {
 
             const { config } = await init();
 
-            const { backup_dir, db_file_path } = grabDBDir({ config });
+            const { backup_dir } = grabDBDir({ config });
 
             const new_db_file_name = grabDBBackupFileName({ config });
 
-            fs.cpSync(db_file_path, path.join(backup_dir, new_db_file_name));
+            snapshotDb({
+                db: DbClient,
+                dst: path.join(backup_dir, new_db_file_name),
+            });
 
             trimBackups({ config });