fix(rest): allow REST API queries to bypass allowlist when enabled (#52)

[Aj2280]

Purpose

Resolves #52.

When ENABLE_ALLOWLIST = 1 is set in wrangler.toml, accessing REST API endpoints (/rest/...) fails because the queries generated by LiteREST (internal schema introspection such as PRAGMA table_info(...) and parameterized CRUD operations) are blocked by the static SQL allowlist check.

This PR provides a clean and secure resolution without introducing regex loopholes into isQueryAllowed (which would allow arbitrary external /query requests to run unwhitelisted PRAGMA queries):

1. bypassAllowlist flag: Added optional bypassAllowlist?: boolean parameter to executeQuery and executeTransaction in src/operation.ts.
2. Safe internal bypass in LiteREST: LiteREST uses this flag for its internal metadata and parameterized queries by default. Row-Level Security (RLS) and query hooks remain fully active and enforced.
3. Configurable toggle: Added ALLOWLIST_BYPASS_REST = 1 in wrangler.toml and allowlistBypassRest?: boolean in StarbaseDBConfiguration.features (defaults to true), allowing users to toggle this behavior if desired.
4. Zero external loopholes: Raw user SQL queries sent to /query or via WebSockets never set bypassAllowlist and remain strictly validated against tmp_allowlist_queries.

Tasks

• Support bypassAllowlist?: boolean in executeQuery and executeTransaction
• Update LiteREST to bypass allowlist for internal schema and parameterized queries
• Expose ALLOWLIST_BYPASS_REST in wrangler.toml and StarbaseDBConfiguration
• Add Vitest unit tests in src/operation.test.ts and src/literest/index.test.ts
• Ensure Prettier code style and lint-staged pass

Verify

Run Vitest:

npx vitest run src/literest/index.test.ts src/operation.test.ts