Escape state_dir in the db_url derived from it (closes #290)

When db_url is omitted, pixa derives it from state_dir, and it put the
directory name into a file: URL as it was, so a state_dir holding %, ?
or # opened another file and lost the journal mode. The derived URL is
now built with net/url, which percent-encodes the directory name; an
ordinary path gives the same URL as before. When the path written into
the URL starts with //, as for a state_dir of / or one starting with //,
the empty host is kept so SQLite does not read the first name in the
path as a host.

Model: opus-5-5

internal/config/config.go

@@ -338,8 +338,7 @@ func newFromSmartConfig(sc *smartconfig.Config) (*Config, error) {
 				settingName(keyDBURL), errValueEmpty)
 		}
 
-		// The driver sets the journal mode only through a _pragma parameter.
-		c.DBURL = fmt.Sprintf("file:%s/state.sqlite3?_pragma=journal_mode(WAL)", c.StateDir)
+		c.DBURL = defaultDBURL(c.StateDir)
 	}
 
 	if loader.err != nil {
@@ -354,6 +353,30 @@ func newFromSmartConfig(sc *smartconfig.Config) (*Config, error) {
 	return c, nil
 }
 
+// defaultDBURL returns the db_url used when db_url is omitted: the file
+// state.sqlite3 in stateDir, in WAL mode, which the driver sets only
+// through a _pragma parameter. String() percent-encodes any %, ? or # in
+// the directory name, which SQLite decodes back, so the URL names exactly
+// this file. OmitHost writes file:/var/lib/pixa/... instead of
+// file:///var/lib/pixa/..., and keeps a relative stateDir from being read
+// as a host name. The path written into the URL is stateDir followed by
+// /state.sqlite3; when it starts with //, as it does for a stateDir of /
+// or one starting with //, the empty host is kept, so the URL starts
+// file://// and SQLite does not read the first name in the path as a
+// host.
+func defaultDBURL(stateDir string) string {
+	dbPath := stateDir + "/state.sqlite3"
+
+	dbURL := url.URL{
+		Scheme:   "file",
+		OmitHost: !strings.HasPrefix(dbPath, "//"),
+		Path:     dbPath,
+		RawQuery: "_pragma=journal_mode(WAL)",
+	}
+
+	return dbURL.String()
+}
+
 // validateKnownKeys rejects configuration files containing keys the
 // application does not understand, so typos fail at startup instead of
 // being silently ignored, and rejects keys that are explicitly set to