security: validate SQLite URI path against '?' and '#' injection (#141)

The --store path is embedded in a SQLite URI via fmt.Sprintf. A path
containing '?' could inject additional connection parameters. Reject
paths with '?' or '#' before constructing the URI.

internal/store/db.go

@@ -20,6 +20,10 @@ func Open(path string) (*DB, error) {
 	if strings.TrimSpace(path) == "" {
 		return nil, fmt.Errorf("db path is required")
 	}
+	// Reject paths that could inject SQLite URI parameters (#59).
+	if strings.ContainsAny(path, "?#") {
+		return nil, fmt.Errorf("db path must not contain '?' or '#'")
+	}
 	if err := os.MkdirAll(filepath.Dir(path), 0o700); err != nil {
 		return nil, fmt.Errorf("create db directory: %w", err)
 	}