bug(sql): injectSqlLimit must not rewrite LIMIT inside string literals

[ZhuchkaTriplesix]

Parent

Part of #463

Severity

High

Problem

injectSqlLimit / clamp path uses regex _limitCount.firstMatch + replaceFirst on raw SQL. A LIMIT n sequence inside a string literal (e.g. WHERE note = 'Use LIMIT 999999 rows') is treated as a real clause and rewritten. Query still parses but filters return wrong rows with no error.

Evidence

• lib/core/database/sql_limit.dart (~55–65)
• Bugbot review dev vs main (2026-07-27)

Acceptance

• LIMIT inside single-quoted (and preferably dollar-quoted) literals is not clamped/replaced
• Real top-level / trailing LIMIT / FETCH still clamped
• Unit tests covering string-literal false positive + real LIMIT clamp

Suggested fix

SQL-aware scan (skip quoted spans) before applying limit regex; or only rewrite the last statement’s trailing LIMIT outside quotes.

[ZhuchkaTriplesix]

Fixed in #469 (merged to dev).