fix: use parameterized LIMIT/OFFSET in activity query to prevent SQL injection

Author: ddrayko

services/activity.js

@@ -13,8 +13,8 @@ export async function logActivity(userId, action, details = '', serverId = null)
 
 export async function getRecentActivity(userId, limit = 20, offset = 0) {
   const rows = await query(
-    `SELECT *, (SELECT COUNT(*) FROM activity_log WHERE user_id = ?) as _total FROM activity_log WHERE user_id = ? ORDER BY created_at DESC LIMIT ${parseInt(offset, 10)}, ${parseInt(limit, 10)}`,
-    [userId, userId]
+    'SELECT *, (SELECT COUNT(*) FROM activity_log WHERE user_id = ?) as _total FROM activity_log WHERE user_id = ? ORDER BY created_at DESC LIMIT ? OFFSET ?',
+    [userId, userId, parseInt(limit, 10), parseInt(offset, 10)]
   );
   const total = rows.length > 0 ? Number(rows[0]._total) : 0;
   rows.forEach(r => delete r._total);