fix: add column whitelist to queryTopN to prevent SQL injection

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/storage/sqlite.go

@@ -292,6 +292,13 @@ func (s *SQLiteStore) GetTopIPs(ctx context.Context, limit int) ([]TopEntry, err
 }
 
 func (s *SQLiteStore) queryTopN(ctx context.Context, column string, limit int) ([]TopEntry, error) {
+	switch column {
+	case "username", "password", "ip":
+		// valid columns
+	default:
+		return nil, fmt.Errorf("invalid column: %s", column)
+	}
+
 	query := fmt.Sprintf(`
 		SELECT %s, SUM(count) AS total
 		FROM login_attempts