fix: request-validator hardening (#192, heuristic scope)

[jrosskopf]

From the crew review; reproduced against a real binary first. Scope chosen by you: heuristic hardening only (structural binding of triple-brace values is not done; the docs now state that bound {{ }} is the real defence).

Summary

• Whitespace bypass: x'<newline>OR 2>1<newline>OR n = 'x returned every row on '{{{ params.name }}}'. The screen now collapses whitespace and inspects the whole value when it contains a quote.
• Unvalidated types: number/float/double/boolean (+ integer/bool) were bindable-classified (skipping the screen) with no validation; 0 OR true passed. Now strictly validated.
• Cache metadata: ?cacheTable=... overrode the server-owned cache table/schema/catalog; now always the configured values.

Behaviour change

A value with a single quote AND an SQL-looking char/word (( ) = < > + * / % & | ;, or/and/like...) is rejected even for a bound {{ }} site (e.g. O'Brien (retired)); a lone apostrophe is fine; preventSqlInjection: false opts out per field.

Test plan

• test_validator_hardening.py: 85 tests, 53 failed before (injection payloads, 4 numeric types x 9 bad values, booleans, cache redirect)
• C++ unit green; 360 related Python tests (sql-injection corpora, validation, prepared, params)

Refs #192 (stays open for the structural fix if you want it later)

🤖 Generated with Claude Code

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}