Restrict learner SQL to the course database and rebuild Windows app

[Personfu]

Finding

The embedded SQLite lab accepted ATTACH DATABASE and VACUUM INTO, so pasted learner SQL could open or create other files with the user's Windows permissions. The tracked CISSQL.exe also needs rebuilding for source fixes to reach users.

Change

• Use SQLite's statement authorizer to reject attach/detach, vacuum export, and file-affecting PRAGMA commands; preserve schema introspection and normal course queries.
• Reapply the authorizer after resetting the lab.
• Add regression tests and a bundled-app --self-test.
• Pin the PyInstaller build dependency, rebuild the tracked Windows executable, and add Windows CI that tests source plus rebuilt EXE.
• Document the lab's actual file boundary.

Verification

• python -m unittest discover -s tests -v: 3 passing
• python _app/cis_sql_course.py --self-test: passing
• Rebuilt CISSQL.exe --self-test: exit 0
• python -m compileall -q _app/cis_sql_course.py tests: passing
• Rebuilt EXE SHA-256: 4B47BF06A8C3DE9DBD3B792E5369EEC448B82FA034E1AA46907C38417AF627B4
• GitHub Dependabot vulnerability alerts enabled for this repository.

The lab remains a local process under the user's OS account; it does not isolate arbitrary executable code.