fix(tui): harden EDITOR handling and SQL sort/order validation

Split EDITOR env var on whitespace so multi-word values like
"code --wait" work correctly. Add allow-list switch for sort column
and order direction at the query boundary to prevent future callers
from passing unsanitized values into SQL.

internal/tui/commands.go

@@ -3,6 +3,7 @@ package tui
 import (
 	"os"
 	"os/exec"
+	"strings"
 	"time"
 
 	"github.com/atotto/clipboard"
@@ -179,10 +180,12 @@ func loadTags(store *db.Store) tea.Cmd {
 }
 
 func editInEditor(store *db.Store, e *db.Entity) tea.Cmd {
-	editor := os.Getenv("EDITOR")
-	if editor == "" {
-		editor = "vi"
+	editorEnv := os.Getenv("EDITOR")
+	if editorEnv == "" {
+		editorEnv = "vi"
 	}
+	parts := strings.Fields(editorEnv)
+	editor, editorArgs := parts[0], parts[1:]
 
 	f, err := os.CreateTemp("", "nib-edit-*.md")
 	if err != nil {
@@ -195,7 +198,7 @@ func editInEditor(store *db.Store, e *db.Entity) tea.Cmd {
 	}
 	f.Close()
 
-	c := exec.Command(editor, f.Name())
+	c := exec.Command(editor, append(editorArgs, f.Name())...)
 	return tea.ExecProcess(c, func(err error) tea.Msg {
 		defer os.Remove(f.Name())
 		if err != nil {