Add forex plugin, stability fixes, and async HTTP dispatch

- Add forex plugin (Frankfurter v2 API) with rate lookups, analysis,
  DM-based alerts, and daily cron poll. Backfills 1 year of history
  on startup for moving averages and buy signal scoring.

- Fix bot hang caused by SQLite lock contention in reminder polling:
  rows cursor was held open while writing to the same DB. Collect
  results first, close cursor, then process. Same fix in milkcarton.

- Add sync retry loop so the bot reconnects after network drops
  instead of silently exiting. StopSync() for clean Ctrl+C shutdown.

- Add panic recovery to all dispatch, syncer, and cron paths.

- Make all HTTP-calling plugin commands async (goroutines) so a slow
  or dead external API cannot block the message dispatch pipeline.
  Affects: lookup, stocks, forex, anime, movies, concerts, gaming,
  retro, wotd, urls, howami.

- Extract DisplayName to Base, add db.Exec helper, convert silent
  error discards across the codebase.

- Fix UNO mercy-kill bug (eliminated bot continues playing), adventure
  DM nag spam, stats column mismatch, per-call regex/replacer allocs.

- Update README: forex commands, Finance section, 47 plugins.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

internal/plugin/achievements.go

@@ -453,7 +453,22 @@ func (p *AchievementsPlugin) buildAchievements() []achievementDef {
 }
 
 // statGTE checks if a user_stats column is >= threshold.
+var allowedStatColumns = map[string]bool{
+	"total_messages":     true,
+	"night_messages":     true,
+	"morning_messages":   true,
+	"total_links":        true,
+	"total_images":       true,
+	"total_questions":    true,
+	"total_emojis":       true,
+	"total_exclamations": true,
+}
+
 func statGTE(d *sql.DB, userID id.UserID, column string, threshold int) bool {
+	if !allowedStatColumns[column] {
+		slog.Error("statGTE: unknown column", "column", column)
+		return false
+	}
 	var val int
 	query := fmt.Sprintf(`SELECT COALESCE(%s, 0) FROM user_stats WHERE user_id = ?`, column)
 	err := d.QueryRow(query, string(userID)).Scan(&val)