fix(exploits): escape {query} brace crashing SQLi exploit generation

What

_generate_sql_injection_exploit in hexstrike_server.py builds the SQLi exploit script with an outer f-string. One line in the template keeps {query} single-braced:

payload = f"1' UNION SELECT 1,({query}),3--"

Python interpolates {query} while building the template, query does not exist in that scope, and the whole call raises NameError: name 'query' is not defined. Every SQLi exploit generation crashes. The generated script needs the literal text {query} for its own f-string (its extract_database_info loops over queries.items()), so the fix is to double the braces: {{query}}.

Reproduction

from hexstrike_server import AIExploitGenerator
g = AIExploitGenerator()
g._generate_sql_injection_exploit(
    {"cve_id": "CVE-2024-0001", "description": "SQLi in example"},
    {},
    {"software": "ExampleApp", "version": "1.0"},
)
# NameError: name 'query' is not defined

An audit of every single-brace expression in the template shows this is the only stray one; the rest (cve_id, endpoint, parameter, ...) are defined in the method.

Verification

After the fix the call returns the generated script, the emitted line still reads ({query}) as the generated script intends, and the generated script itself passes py_compile.

Relation to #210

#210 sanitizes the header interpolations of this same method (RCE hardening, issue #204). This PR is a separate concern on a different line: a crash that makes the generator unusable. The two patches touch different parts of the template and merge cleanly.