fix: quote string parameters in prepareQuery to prevent PostgreSQL type errors

[gakonst]

Problem

String parameters like hex addresses (0xabc...) were being inserted into SQL queries without quotes via String(param), causing PostgreSQL to interpret them as bit literals instead of text values.

This resulted in bytea = bit type mismatch errors when queries had many OR conditions (e.g., >18 parameters).

Reproduction

// This fails with 'bytea = bit' error when hashList.length > ~18
const result = await QB.selectFrom('txs')
  .where('chain', '=', chainId)
  .where((eb) => eb.or(hashList.map((hash) => eb('hash', '=', hash))))
  .execute()

Root Cause

In prepareQuery(), line 373:

query = query.replaceAll(placeholder, String(param))

This converts 0xabc123... without SQL quoting, so PostgreSQL sees an unquoted 0x... which it interprets as a bit literal.

Solution

1. Quote string parameters with single quotes and escape embedded quotes
2. Sort replacements by placeholder length descending to ensure $10 is replaced before $1 (prevents partial replacements like $1 matching inside $10)

Testing

Verified fix resolves the issue in tempo-apps explorer with queries containing 20+ hash parameters.