fix: parameterize SQL timeout, guard data-URL parse, cleanup frontend bugs

[houxio]

Summary

• SQL injection fix: PostgreSQL/MySQL drivers — replace f-string interpolation with parameterized queries for statement_timeout / MAX_EXECUTION_TIME
• Data URL parse guard: chat.py — two MIME extraction sites split(":")[1] now guarded against malformed URLs to prevent IndexError
• Frontend cleanup: remove redundant ternary in ai-panel.tsx; add AbortController to image fetch in playground-page.tsx so in-flight requests cancel on unmount

Test plan

• Database connector query execution — verify timeout parameterization works (PostgreSQL / MySQL)
• Upload images in chat — confirm MIME type extracted correctly
• Agent/Connector builder init failure — toast displays normally
• Playground rapid message switching — confirm stale image requests are aborted (DevTools Network tab)

[tao-hpu]

Thanks for the bundle — 4 of the 5 changes look great and ready to merge. One blocker on the PostgreSQL side before I can pull this in:

PG driver regression (src/fim_one/core/tool/connector/database/drivers/postgresql.py):

await conn.execute("SET statement_timeout = \$1", int(timeout_s * 1000))

PostgreSQL's SET is a utility statement and does not accept bind parameters — asyncpg will hand \$1 to the server's prepare phase and PG returns a syntax error. Net effect: every query through the PG connector would fail at the timeout step.

The original f-string wasn't actually injectable here (timeout_s: int = 30 is an internal kwarg, never user-supplied), so the safe minimal fix is an explicit int coercion:

await conn.execute(f"SET statement_timeout = {int(timeout_s * 1000)}")

That keeps the spirit of the hardening (defense-in-depth against future refactors passing a non-int) without breaking the driver.

The other 4 changes are good to go as-is:

• ✅ MySQL %s parameterization (aiomysql does client-side substitution, works fine)
• ✅ chat.py data-URL guard with split(":", 1) + fallback MIME — nice defensive touch
• ✅ ai-panel.tsx redundant ternary removal
• ✅ playground-page.tsx AbortController — strictly better than the revoked flag, cancels in-flight fetch too

Once the PG line is reverted to the int-coerced f-string, I'll approve and squash-merge. Appreciate the cleanup!

[houxio]

Good catch — reverted to int-coerced f-string in cc1e7a6. Ready for re-review.

[tao-hpu]

Fix verified — int-coerced f-string is the right minimal patch. Thanks for the fast turnaround!