fix: update query method to use non-prepared statements for dynamic SQL compatibility

database/database.js

@@ -78,9 +78,10 @@ module.exports = {
       throw error;
     }
   },
-  // Alias for execute to maintain compatibility
+  // Non-prepared query – avoids server-side prepared-statement issues
+  // (e.g. "Incorrect arguments to mysqld_stmt_execute" with dynamic SQL)
   async query(query, params = []) {
-    return await pool.execute(query, params);
+    return await pool.query(query, params);
   },
   // Get single row
   async get(query, params = []) {