v1.0.2

A security-shaped cleanup: SQL statements are no longer assembled at runtime.

Statements are constants again. CodeQL flagged four go/sql-injection paths. None
was exploitable — every fragment concatenated into a statement was a literal and every
value went through ?. But the alerts were fair: xorm's Exec/QueryString take
(...any) with the statement as one element of the slice, so once the statement and
user input share a slice, neither a static analyser nor a reader can tell them apart
without following twenty lines of building logic.

The three admin queries now pass the statement separately, and the channel update is
one constant statement with COALESCE(?, column) instead of a SET clause built from
whichever fields were present — which is what that API meant all along.

Fixed while testing it: ChannelInput accepts mute_until, and channel creation
never read it. The value was silently dropped while the caller assumed it was set.

Three new tests pin the partial-update semantics: updating one field leaves the others
alone, an empty string means clear this rather than leave it, and mute_until: 0
cancels a scheduled mute.

Upgrading: pull the new image — no schema changes, no configuration changes.

Images: ghcr.io/aichy126/knockbox:v1.0.2 · aichy66/knockbox:v1.0.2