Fix critical security vulnerabilities and bugs

[YashejShah]

Summary

• Fix SQL injection in PostgreSQL adapter (SqlDB) — column names are now validated against a strict identifier regex before interpolation
• Eliminate eval() RCE vectors — replaced unsafe eval() with ast.literal_eval() in json_parser, _get_value, and nightmode; built a safe AST-based math evaluator for the calculator plugin
• Fix command injection via user-controlled ADDONS_URL — all subprocess.run(shell=True) calls converted to list-form (no shell)
• Replace os.system() calls with subprocess.check_call() in _database.py for safer package installation
• Fix Terminal.terminate() bug — process was popped from dict before .kill() was called, so it never actually killed anything
• Fix _auto_remove_processes — was a @property with an infinite while loop iterating PIDs as if they were process objects; replaced with a proper cleanup method
• Fix __dict__ property override in BaseClient that broke Python introspection; renamed to as_dict()
• Fix infinite retry loops in fast_uploader/fast_downloader — now limited to 3 retries with proper error reporting
• Fix mediainfo() missing else — "video as doc" always overwrote "video" regardless of streaming support check
• Fix ThreadPoolExecutor leak — run_async was creating a new executor per call; now uses a shared instance
• Fix missing f-string in ssgen.py that printed literal {ultroid.session.save()} instead of the actual session
• Pin dependency versions in requirements.txt to prevent supply-chain issues

Test plan

• Verify bot starts normally with Redis/Mongo/SQL database backends
• Test .calc command with basic math expressions
• Test .bash and .eval commands (owner only)
• Test nightmode scheduling with custom times
• Test file upload/download via bot
• Verify addon loading works with ADDONS_URL set
• Confirm no regressions in plugin loading

🤖 Generated with Claude Code