filer: escape LIKE wildcards in SQL list prefixes (#11757)

* filer: escape LIKE wildcards in SQL list prefixes

ListDirectoryPrefixedEntries bound prefix+"%" straight into a LIKE
clause, so '_' and '%' in object names (e.g. Langfuse keys like
call_03_...) acted as wildcards: wrong results and a ~40x slower
range scan because (dirhash, name) can no longer be narrowed.

Escape '!'/'%'/'_' in the prefix and declare ESCAPE '!' in the
generated list SQL so every abstract_sql backend (mysql, mysql2,
postgres, postgres2, sqlite) matches literally with identical
semantics. '!' is used instead of '\' because SQLite shares
SqlGenMysql but would reject the MySQL-style '\\' literal, and
'\' would still need escaping itself.

* filer: escape LIKE wildcards in YDB list prefixes

Same wildcard-in-prefix bug as the abstract_sql backends: YQL LIKE
treated '_' and '%' in the prefix as wildcards. Apply the shared
LikePattern helper and declare ESCAPE '!' (YQL allows any escape
char except '%', '_' and '\').

* test: cover literal '_'/'%'/'!' prefixes in sqlite filer listing

End-to-end regression test through SqliteStore against a real
database; runs in CI under the sqlite build tag.

weed/filer/abstract_sql/abstract_sql_store.go

@@ -390,6 +390,14 @@ func (store *AbstractSqlStore) DeleteFolderChildren(ctx context.Context, fullpat
 	return doDeleteFolderChildren()
 }
 
+var likeEscaper = strings.NewReplacer("!", "!!", "%", "!%", "_", "!_")
+
+// LikePattern escapes LIKE wildcards so the prefix matches literally;
+// '!' pairs with the ESCAPE '!' clause emitted by the SqlGenerators.
+func LikePattern(prefix string) string {
+	return likeEscaper.Replace(prefix) + "%"
+}
+
 func (store *AbstractSqlStore) ListDirectoryPrefixedEntries(ctx context.Context, dirPath util.FullPath, startFileName string, includeStartFile bool, limit int64, prefix string, eachEntryFunc filer.ListEachEntryFunc) (lastFileName string, err error) {
 
 	db, bucket, shortPath, err := store.getTxOrDB(ctx, dirPath, true)
@@ -402,7 +410,7 @@ func (store *AbstractSqlStore) ListDirectoryPrefixedEntries(ctx context.Context,
 		sqlText = store.GetSqlListInclusive(bucket)
 	}
 
-	rows, err := db.QueryContext(ctx, sqlText, util.HashStringToLong(string(shortPath)), startFileName, string(shortPath), prefix+"%", limit+1)
+	rows, err := db.QueryContext(ctx, sqlText, util.HashStringToLong(string(shortPath)), startFileName, string(shortPath), LikePattern(prefix), limit+1)
 	if err != nil {
 		return lastFileName, fmt.Errorf("list %s : %v", dirPath, err)
 	}

weed/filer/abstract_sql/abstract_sql_store_test.go

@@ -52,6 +52,24 @@ func TestGetTxOrDBRealBucket(t *testing.T) {
 	}
 }
 
+func TestLikePattern(t *testing.T) {
+	cases := []struct {
+		prefix, want string
+	}{
+		{"", "%"},
+		{"plain", "plain%"},
+		{"call_03_KNl", "call!_03!_KNl%"},
+		{"100%", "100!%%"},
+		{"a!b", "a!!b%"},
+		{`a\b`, `a\b%`},
+	}
+	for _, c := range cases {
+		if got := LikePattern(c.prefix); got != c.want {
+			t.Errorf("LikePattern(%q) = %q, want %q", c.prefix, got, c.want)
+		}
+	}
+}
+
 func TestSplitPoolForKv(t *testing.T) {
 	cases := []struct {
 		maxOpen, mainOpen, kvOpen int