SQL runner

Runs as the sandboxed sanam_sqlrunner role inside a transaction (30 s statement timeout, 500 rows shown). Read-only mode accepts a single SELECT. Every execution — including failures — is logged.