fix(mysql): escape SQL identifiers and literals in metadata/DDL paths (#1914)

[HandSonic]

Related issue

Part of the SQL-injection hardening tracked in #1914. This PR covers the MySQL plugin and now builds on the shared forced-quote SPI merged in #2234.

Summary

• Uses ISQLIdentifierProcessor.quoteIdentifierAlways for MySQL DDL and metadata identifier positions, including embedded-backtick escaping and raw-value round trips.
• Escapes MySQL string literals and validates structural tokens such as engine, charset, collation, numeric defaults, bit/hex literals, view options, index direction, and fallback column types.
• Parses ENUM/SET lists before re-escaping so metadata values such as 'can''t' are not escaped twice; malformed lists are rejected.
• Keeps DEFINER validation independent of backslash escape behavior, including NO_BACKSLASH_ESCAPES sessions.
• Hardens table copy/truncate/drop, metadata lookups, routine names, export statements, and export comment headers.
• Fixes qualified DROP VIEW generation while preserving calls that omit the database name.

Table.partition and ModifyView.viewBody remain intentional raw SQL surfaces and are not reinterpreted by this identifier/literal hardening PR.

Affected surfaces

• Frontend / Web
• Backend / API / Storage
• Database plugin / Driver
• JCEF / Desktop packaging
• CI / Build / Release
• Documentation only

Verification

• Command: mvn -B -f chat2db-community-server/pom.xml -pl chat2db-community-plugins/chat2db-community-mysql -am -Dmaven.test.skip=false -DskipTests=false clean test
• Result: BUILD SUCCESS; tests run: 653, failures: 0, errors: 0, skipped: 0.
• Focused escaping tests: 35 passed across the MySQL identifier processor test classes.

Risk and compatibility

• Public API or stored data: N/A.
• Database or driver compatibility: ordinary identifiers retain existing output; embedded delimiters, quoted raw identifiers, malformed ENUM/SET lists, ambiguous DEFINER backslash escapes, and invalid structural tokens now follow explicit safe behavior.
• Network, privacy, or security: closes second-order injection paths in generated MySQL metadata, DDL, DML, and export SQL.
• Community / Local / Pro boundary: Community MySQL plugin only.
• Backward compatibility: shared SPI source compatibility is provided by feat(spi): add quoteIdentifierAlways to ISQLIdentifierProcessor #2234; this PR uses the MySQL override for forced backtick quoting.

Reviewer map

• Start with MysqlIdentifierProcessor, MysqlSqlGuards, and MysqlIdentifierProcessorTest.
• Then review the builder/metadata/manager call sites and binary/varbinary value processors.
• Failure condition: an identifier or literal sink covered by this PR still receives an unescaped value, or a legitimate raw identifier fails the forced-quote round trip.
• Rollback path: revert this PR.

Contributor declaration

• I linked the Issue that defines this change.
• I tested the affected behavior and reported the actual results above.
• I did not include credentials, private data, or generated build output.
• I disclosed substantial AI assistance below, or this PR contains no substantial AI-generated code.

AI assistance: The fix, review, verification, and PR description were produced with AI coding assistance.

[HandSonic]

Converting to draft: final adversarial review pass is still in progress for this branch. Will mark ready for review once it completes. (process note: PR was opened prematurely by automation)

[openai0229]

Rebased onto #2234 and verified the final MySQL implementation. Identifier round trips, DEFINER handling, ENUM/SET literals, fallback type rendering, export titles, DROP VIEW, and generated DDL behavior are covered. Local clean reactor result: 653 tests, 0 failures or errors.