fix(security): SQL injection in Python/JS clients + bare except + session leak

- Fix SQL injection vulnerabilities in chat_history.py, langchain_store.py,
  rag_pipeline.py, baradb_langchain.js by switching to parameterized queries
- Replace dangerous bare except: with except CatchableError:/ValueError:
  in llm.nim, embed.nim, cypher.nim, mcp/server.nim, executor.nim
- Fix session variable leak in MCP handleVectorSearch/handleSchemaInspect
- Build: 0 errors, all tests pass

src/barabadb/ai/embed.nim

@@ -55,7 +55,7 @@ proc embed*(e: Embedder, text: string): seq[float32] =
     elif data.hasKey("data") and data["data"].kind == JArray and data["data"].len > 0:
       for val in data["data"][0]["embedding"]:
         result.add(float32(val.getFloat()))
-  except:
+  except CatchableError:
     discard
   finally:
     client.close()
@@ -83,5 +83,5 @@ proc jsonToVector*(s: string): seq[float32] =
     if p.len > 0:
       try:
         result.add(parseFloat(p))
-      except:
+      except CatchableError:
         discard

src/barabadb/ai/llm.nim

@@ -78,7 +78,7 @@ proc generate*(client: LLMClient, prompt: string, systemPrompt: string = ""): st
         result = data["response"].getStr()
       elif data.hasKey("choices") and data["choices"].kind == JArray and data["choices"].len > 0:
         result = data["choices"][0]["message"]["content"].getStr()
-  except:
+  except CatchableError:
     result = ""
   finally:
     httpClient.close()