fix: P0-01 prevent LIKE injection in operation_log and device repos

- operation_log.go Search(): add escapeLikePattern + ESCAPE clause
- device.go ListAllCursor(): add escapeLikePattern + ESCAPE clause

The ESCAPE clause is required for SQLite to properly interpret
backslash as an escape character.

internal/repository/device.go

@@ -275,8 +275,9 @@ func (r *DeviceRepository) ListAllCursor(ctx context.Context, params *ListDevice
 		query = query.Where("is_trusted = ?", *params.IsTrusted)
 	}
 	if params.Keyword != "" {
-		search := "%" + params.Keyword + "%"
-		query = query.Where("device_name LIKE ? OR ip LIKE ? OR location LIKE ?", search, search, search)
+		escapedKeyword := escapeLikePattern(params.Keyword)
+		pattern := "%" + escapedKeyword + "%"
+		query = query.Where("device_name LIKE ? ESCAPE '\\' OR ip LIKE ? ESCAPE '\\' OR location LIKE ? ESCAPE '\\'", pattern, pattern, pattern)
 	}
 
 	// Apply cursor condition for keyset navigation