feat: query variables ({name:Type}) with native param_ substitution (#134)

[BorisTyshkevich]

What & why

Closes #134.

Adds query variables: ClickHouse typed placeholders {name:Type} are detected while editing, and a single-line strip below the editor toolbar shows one input per detected variable (it scrolls horizontally when there are many, and is hidden when there are none). Run is disabled until every variable has a value.

On execution the entered values are sent as ClickHouse's native param_<name> query-string arguments, so the server substitutes them per the declared type — injection-safe and type-correct (String/Identifier/DateTime/Array(…)/Map(…) all work). The SQL text itself is sent unchanged; the app never string-rewrites the query.

Substitution is gated on row-returning statements only, so a CREATE VIEW … {x:String} … definition is stored with its placeholder intact — which is exactly how ClickHouse parameterized views work. The gate and the param-passing live at the shared execution choke points (run / runScript / export), so Run, ⌘↵, Explain, and Export all honor them.

Design decisions (agreed on the issue)

• Native param_* substitution, not client-side string rewriting.
• Substitute reads only (SELECT/WITH…SELECT/EXPLAIN); never DDL/CREATE VIEW.
• Values are shared by variable name and persisted (asb:varValues): a value typed once is reused/prefilled wherever the same variable appears — across queries, tabs, history/library loads, and reloads. (Updated from the original "per-tab, in-memory" decision per review feedback on the PR.)
• Run disabled until all filled; the strip is a single non-wrapping row that scrolls at any width (verified at 360px on chromium + webkit — single row, scrolls, no page clip).

Distinct from #39's {{name}} composable-query CTE-merge (different syntax and purpose) — noted in the roadmap and the issue.

How it's built

• New pure src/core/query-params.js — detectParams (lexer skips string literals + comments and handles nested-paren types, mirroring sql-split.js), readStatementParams, paramArgs, missingValues, unfilledParams — 100% covered.
• src/ui/app.js — variable strip render, the shared varGateBlocked gate, and param_* merge into run/runScript/exportDirect/exportScript. No new dependency; rides the existing fetch seam.

Follow-up (filed separately, not in this PR)

• The literal/comment lexer is now hand-maintained in both sql-split.js and query-params.js; a shared span-scanner would remove the duplication (and fix a rare edge — a } inside a quoted Enum type label in the type position). Filed as Extract a shared SQL span-scanner for sql-split.js + query-params.js #139 (inbox).

Checklist

• npm test passes (per-file coverage gate; query-params.js 100/100/100/100, app.js 100 lines/statements)
• Tests added/updated in the same change as the code
• npm run build succeeds (single-file dist/sql.html)
• Layers kept honest: pure logic in src/core/, DOM in src/ui/
• No new runtime dependency
• README / CHANGELOG.md ([Unreleased]) updated
• Reconciled tracked work (roadmap Roadmap to 1.0.0 #68 updated with Support variables in SELECT queries #134 + the Composable queries: reference other library queries via {{name}} (CTE-merge) #39 distinction)

🤖 Generated with Claude Code