fix(usage): address code review findings - SQL injection, stream usage recording, DB singleton

package-lock.json

@@ -51,6 +51,7 @@
         "electron-squirrel-startup": "^1.0.1",
         "fastify": "^5.8.4",
         "find-process": "^2.0.0",
+        "gpt-tokenizer": "^3.4.0",
         "i18next": "^25.6.3",
         "i18next-browser-languagedetector": "^8.2.0",
         "keytar": "^7.9.0",
@@ -18531,6 +18532,12 @@
         "url": "https://github.com/sindresorhus/got?sponsor=1"
       }
     },
+    "node_modules/gpt-tokenizer": {
+      "version": "3.4.0",
+      "resolved": "https://registry.npmjs.org/gpt-tokenizer/-/gpt-tokenizer-3.4.0.tgz",
+      "integrity": "sha512-wxFLnhIXTDjYebd9A9pGl3e31ZpSypbpIJSOswbgop5jLte/AsZVDvjlbEuVFlsqZixVKqbcoNmRlFDf6pz/UQ==",
+      "license": "MIT"
+    },
     "node_modules/graceful-fs": {
       "version": "4.2.11",
       "resolved": "https://registry.npmjs.org/graceful-fs/-/graceful-fs-4.2.11.tgz",