feat(sql-editor): add JS/TS code cells with allowlisted imports

[huyplb]

Embed -- @js/-- @ts fences in the query editor so post-SQL transforms can run in a sandboxed worker with last/vars, required returns, and lodash/date-fns imports.

---

Note

Medium Risk
User-supplied code runs in-browser via new Function (mitigated by worker, timeout, and allowlist) and touches the shared statement-split/run pipeline; not server-side RCE but still untrusted script execution in the client.

Overview
Adds JS/TypeScript code cells to the SQL editor so you can transform query results in the same script as SQL, using -- @js / -- @ts … -- @end fences.

Core (@foxschema/core) extends statement splitting so fenced cells stay one statement (inner semicolons don’t split), exposes StatementKind, validates missing @end / required return, and treats code cells as non-write statements.

Execution runs cells in a Web Worker (sync fallback for tests) with a 5s timeout: TS is transpiled client-side, last is the prior statement’s grid, vars are non-secret editor variables, returns normalize to { columns, rows } or object arrays with row caps. Sandboxed new Function blocks network/DOM globals; allowlisted top-level imports only (lodash, lodash-es, date-fns via new deps). @set inside or above fences still applies from the first successful credential like SQL.

UI & run loop: the statement strip shows JS/TS badges; results label code queries; execute branches to runCodeCell per connection and disables paging for those steps. DataGrid styling is pinned via .fox-sql-grid so the light result table stays readable on soft-dark themes. User guide documents the feature; unit tests cover splitter, imports, and execution.

^{Reviewed by Cursor Bugbot for commit 2a956b3. Bugbot is set up for automated code reviews on this repo. Configure here.}