Fix SQL injection, schema-sync data loss, and backup safety

Security:
- select: bind parameters instead of mysql.format (backslash escaping
  allowed injection on SQLite); drop the mysql dependency
- validate all interpolated identifiers, limit/offset/page, order
  strategy, operators, join types and raw equalities (new sql-safe.ts)
- quote identifiers and bind values in schema manager DDL/queries

Data loss:
- schema sync runs with foreign keys off inside a transaction, with
  foreign_key_check before commit (DROP TABLE no longer cascades)
- parentTableName tables: stop mutating the parent schema and copy
  inherited columns on rebuild
- keep column data on type changes (match columns by name)
- backups and schema snapshots use VACUUM INTO (includes WAL data);
  restore closes the DB, clears -wal/-shm, and swaps atomically
- backup listing/trimming only touches <db_name>-<timestamp> files

Correctness:
- update/delete use the generator's WHERE clause instead of a regex
- keep 0/""/false values; booleans stored as 0/1
- IN/NOT IN and BETWEEN arrays, NOT LIKE wrapping, AVG, select aliases
- OFFSET without LIMIT, count ignores pagination
- MATCH emits `field MATCH fn(?)` for sqlite-vec
- sql() returns rows for any row-producing statement
- targetId no longer mutates the caller's query
- init throws instead of process.exit; CLI reports errors

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/utils/sql-generator-gen-join-str.ts

@@ -3,6 +3,7 @@ import type {
     ServerQueryParamsJoinMatchObject,
     SQLInsertGenValueType,
 } from "../types";
+import { sqlIdent, sqlOperator, sqlRawEquality } from "./sql-safe";
 
 type Param = {
     mtch: ServerQueryParamsJoinMatchObject;
@@ -33,7 +34,7 @@ export default function sqlGenGenJoinStr({ join, mtch, table_name }: Param) {
             values.push(...batch_values);
 
             if (i < mtch.__batch.matches.length - 1) {
-                btch_mtch += ` ${mtch.__batch.operator || "OR"} `;
+                btch_mtch += ` ${sqlOperator(mtch.__batch.operator, "OR")} `;
             }
         }
 
@@ -45,44 +46,15 @@ export default function sqlGenGenJoinStr({ join, mtch, table_name }: Param) {
         };
     }
 
-    const equality = mtch.raw_equality || "=";
+    const equality = mtch.raw_equality ? sqlRawEquality(mtch.raw_equality) : "=";
 
-    const lhs = `${
-        typeof mtch.source == "object" ? mtch.source.tableName : table_name
-    }.${typeof mtch.source == "object" ? mtch.source.fieldName : mtch.source}`;
-
-    const rhs = `${(() => {
-        if (mtch.targetLiteral) {
-            values.push(mtch.targetLiteral);
-
-            // if (typeof mtch.targetLiteral == "number") {
-            //     return `${mtch.targetLiteral}`;
-            // }
-            // return `'${mtch.targetLiteral}'`;
-
-            return `?`;
-        }
-
-        if (join.alias) {
-            return `${
-                typeof mtch.target == "object"
-                    ? mtch.target.tableName
-                    : join.alias
-            }.${
-                typeof mtch.target == "object"
-                    ? mtch.target.fieldName
-                    : mtch.target
-            }`;
-        }
-
-        return `${
-            typeof mtch.target == "object"
-                ? mtch.target.tableName
-                : join.tableName
-        }.${
-            typeof mtch.target == "object" ? mtch.target.fieldName : mtch.target
-        }`;
-    })()}`;
+    const lhs = `${sqlIdent(
+        typeof mtch.source == "object" ? mtch.source.tableName : table_name,
+        "table name",
+    )}.${sqlIdent(
+        typeof mtch.source == "object" ? mtch.source.fieldName : mtch.source,
+        "field name",
+    )}`;
 
     if (mtch.between) {
         values.push(mtch.between.min, mtch.between.max);
@@ -102,6 +74,28 @@ export default function sqlGenGenJoinStr({ join, mtch, table_name }: Param) {
         };
     }
 
+    const rhs = (() => {
+        if (mtch.targetLiteral !== undefined && mtch.targetLiteral !== null) {
+            values.push(mtch.targetLiteral);
+            return `?`;
+        }
+
+        const targetTable =
+            typeof mtch.target == "object"
+                ? mtch.target.tableName
+                : join.alias || join.tableName;
+
+        const targetField =
+            typeof mtch.target == "object"
+                ? mtch.target.fieldName
+                : mtch.target;
+
+        return `${sqlIdent(targetTable, "table name")}.${sqlIdent(
+            targetField,
+            "field name",
+        )}`;
+    })();
+
     return {
         str: `${lhs} ${equality} ${rhs}`,
         values,