fix(linux): address the review findings on steps 40 to 45

[datlechin]

Why

The Codex and security reviews of #3413 found seven defects in Steps 40 to 45.

Change

• Query history withholds a credential function called in a join or WHERE condition, MySQL CLONE ... IDENTIFIED BY, and encryption calls that take a key (MySQL AES and DES, pgcrypto, ClickHouse).
• Replace Key and Connect only removes a key for the session's own hosts and known_hosts files, as ssh -G resolves them; a trusted key matches host and fingerprint together.
• Opening a file only matches a saved file connection whose database is an absolute path, never a network connection.
• A SQLite rebuild refuses a new foreign key violation even when the row broke the old key; a cell menu acts only on the rows it opened for; a launch during the quit's last write restores the sessions.

Verified

Each fix has a test that fails without it; fmt, both clippy runs, nextest and cargo test suites pass in the ubuntu:26.04 image.

Not in this PR

• Replace is refused for a UserKnownHostsFile path with a space, which ssh -G prints unquoted.