fix: SQL injection, auth required on db endpoints, broadcast escape

Feat: forward channel_id + message_id to archiver instead of download_url