fix(sandbox): declarative engine strips JSONC comments inside strings; sql.format and sql.parse are regex-based #1567

Problem

DeclarativeEmbeddedEngine (lib/core/extensions/sandbox/embedded/declarative_embedded_engine.dart) runs Level-1 JSON/JSONC modules for extensions. Three of its helpers use regexes where a scanner is needed:

1. _parseJsoncObject (:230-238) breaks on any // or /* inside a string. It removes comments with //[^\n]* and /\*[\s\S]*?\*/ over the raw text, so {"homepage": "https://example.com"} becomes {"homepage": "https: and the module fails with FormatException. Trailing commas, which JSONC allows, are not handled either. The repo already has a correct scanner: stripJsonc in lib/core/theme/parser/jsonc_preprocessor.dart (string-aware, handles trailing commas). Use it.
2. sql.format (:120-164) changes literals and does extra work. It compiles 21 RegExps per call (one per keyword plus two) and makes 23 passes over the string. [ \t]+ -> ' ' collapses spaces inside string literals; \s*;\s* -> ';\n' inserts newlines inside literals; keyword uppercasing rewrites 'order by' and "select". Use the segment-aware formatter from the editor fix (fix(editor): Format SQL uppercases words inside string literals, quoted identifiers and comments #1566) instead of a second implementation.
3. sql.parse (:219) splits the whole statement on whitespace to read the first word, and returns -- / /* when the statement starts with a comment. Use one firstMatch after skipping leading comments (stripLeadingWhitespaceAndLineComments exists in core/database).

Scope

EmbeddedSandboxRuntime has no callers outside lib/core/extensions/sandbox/embedded/ yet (only tests), so nothing breaks for users today. Fix before the runtime is wired to extensions.

Tests

JSONC with a URL value, /* inside a string, trailing comma; sql.format with keywords and ; inside literals; sql.parse with a leading comment.