fix: use D1 database layer in API routes and fix SQL injection

[Rayhan1967]

Summary

This PR fixes two critical issues that prevent the application from working correctly on Cloudflare Pages:

1. Database Layer Mismatch (Critical)

Problem: API routes were using SQLite functions (better-sqlite3) which don't work in Cloudflare Workers environment.

Solution: Migrated all API routes and page components to use the D1 database layer (@/lib/db/d1) instead of SQLite.

Files changed:

• src/app/api/recordings/[id]/route.ts
• src/app/api/recordings/[id]/summary/route.ts
• src/app/api/recordings/[id]/clips/route.ts
• src/app/api/clips/route.ts
• src/app/api/clips/[clipId]/route.ts
• src/app/api/speakers/route.ts
• src/app/api/participants/route.ts
• src/app/api/recordings/paginated/route.ts
• src/app/recordings/[id]/page.tsx
• src/app/c/[clipId]/page.tsx

2. SQL Injection Vulnerability (High)

Problem: In searchRecordingsWithContext(), the source parameter was being interpolated directly into the SQL query string, which is a security risk.

Location: src/lib/db/index.ts:324

Before:

const sourceFilter = source && source !== "all" ? \`AND r.source = '\${source}'\` : "";

After:

const sourceFilter = source && source !== "all" ? \`AND r.source = ?\` : "";
const sourceParam = source && source !== "all" ? source : null;
// ...
.bind(..., ...(sourceParam ? [sourceParam] : []))

Additional Changes

• Added missing functions to D1 layer: getSpeakersByRecordingIds, getSummariesByRecordingIds, dbRowToClip, dbRowToRecording
• Added type re-exports in D1 module for TypeScript compatibility

Verification

• ✅ Lint passes
• ✅ Build passes
• ✅ All changes are backward compatible (SQLite module preserved for sync scripts)