fix(excel-import): escape cell values in INSERT statements

[Aias00]

Related issue

Closes #2015

Summary

ReadHeaderListener.buildSql concatenated raw cell values into INSERT
VALUES (...) with surrounding single quotes and no escaping:

valueList.add("'" + v + "'");

A cell value containing an apostrophe (e.g. O'Brien) became 'O'Brien'
and broke the generated SQL; in a shared/web deployment a crafted import
file could inject SQL into the batch executed against the target
connection.

The fix routes values through the existing
EasyStringUtils.escapeAndQuoteString(...), which doubles single quotes
(' -> '') and backslashes (\\ -> \\\\) and wraps the value in
quotes — the same path the sibling importer uses via
DefaultValueProcessor.getSqlValueString -> escapeAndQuoteString.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Commands and results:
  • mvn -B -f chat2db-community-server/pom.xml -pl chat2db-community-tools -am -Dmaven.test.skip=false -DskipTests=false -Dtest=ai.chat2db.community.tools.util.EasyStringUtilsTest -Dsurefire.failIfNoSpecifiedTests=false -Dmaven.test.failure.ignore=false test -> Tests run: 3, Failures: 0, Errors: 0; reactor BUILD SUCCESS.
  • mvn -B -q -f chat2db-community-server/pom.xml -pl chat2db-community-domain/chat2db-community-domain-core -am -Dmaven.test.skip=true compile -> BUILD SUCCESS (import resolves; chat2db-community-tools is already a dependency of domain-core and EasyStringUtils is already used by SQLImporter in the same module).
• Manual verification: escapeAndQuoteString("O'Brien") returns 'O''Brien' (covered by the new test).
• UI evidence: N/A

Risk and compatibility

• Public API or stored data: N/A — only changes generated INSERT text.
• Database or driver compatibility: Quote-doubling ('') is standard ANSI SQL string escaping and is accepted by the supported databases; the same util is already used by the default value processor across plugins.
• Network, privacy, or security: Fixes an injection/breakage vector in the Excel/CSV import path. If considered security-sensitive, this can be re-evaluated under the repository security policy; the fix is unchanged.
• Community / Local / Pro boundary: N/A.
• Backward compatibility: Values without quotes/backslashes produce identical output ('value'); only previously-broken/injectable inputs now import correctly.

Reviewer map

• Start here: ReadHeaderListener.java:161 — "'" + v + "'" -> EasyStringUtils.escapeAndQuoteString(v.toString())); new import ai.chat2db.community.tools.util.EasyStringUtils. New test EasyStringUtilsTest.
• Failure condition: A cell value containing a single quote breaks the import or alters the executed statement.
• Rollback or disable path: Revert this single commit.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: The fix, test, verification, and PR description were produced with Claude Code assistance.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[openai0229]

Reviewed the Excel/CSV SQL generation path and the existing value-processor escaping contract. The change safely quotes apostrophes through the shared helper; the 3 focused tests pass, domain-core packages locally, the exact Java change previously passed Java CodeQL, and the latest required checks are green. No blocking issues found.