Chain params, lower() in LIKE, project AS aliases

[adsharma]

Follow-up to #13, driven by flipping production reads onto chains:

• param("name") in any value position (comparisons, LIKE/MATCH patterns); resolved against the params dict at render time, missing names raise. User input never touches SQL text.
• like() accepts lower(field) as its field argument (case-insensitive autocomplete).
• project() accepts alias.col AS out (case-insensitive AS) so joined projections with same-named columns don't collide in dict rows.
• to_sql(params) / to_rows(conn, params) thread the bindings through.

Tests in tests/test_sql.py cover all three, incl. a quote-containing bound value.