feat: web Database console (SQL editor + saved queries)

[sg]

What changed

New Database tab on the Manage screen — a simple SQL console over the bot's sqlite DB.

• Query editor across the top ~1/5 of the pane; results fill the rest (each scrolls independently).
• Submit — enabled only when the editor has text; runs the statement and shows a result table (SELECT) or an affected-row count (writes/DDL). SQL errors are shown inline.
• Save / Load / Delete for named queries, stored in a new saved_queries table:
  • Save prompts for a name and upserts by name.
  • Load opens an inline picker; clicking a row loads it into the editor.
  • Delete opens an inline picker with a per-row ✕ and a Cancel button.

Backend

• New saved_queries table; DB.run_raw() executes one statement under the DB lock, returning columns+rows (BLOBs hex-encoded for JSON) or the affected rowcount.
• Management.run_sql / saved_query_list|save|delete, all audited (db.sql, db.query.save, db.query.delete).
• Endpoints (all require_auth): POST /api/db/query, GET/POST /api/db/saved-queries, DELETE /api/db/saved-queries/{id}.

Design decisions / safety

• Full read/write SQL (not SELECT-only), per "issue SQL commands." It runs against the live database — the UI shows a "runs against the live database" caption and every statement is audited.
• Single statement per Submit (sqlite3's own limit), which also blocks ;-chained injection.
• It sits behind the same require_auth as the rest of Manage (which can already edit users/groups and send messages), but arbitrary SQL is strictly more powerful — treat web access accordingly.

Tests

tests/test_db_console.py — SELECT columns/rows, write rowcount, DDL, BLOB hex, audit on success, error/empty/multi-statement rejection, saved-query CRUD + overwrite-by-name + audit. All green; web-ui build clean.

Breaking changes

None — additive (new table auto-created).