hackernews example: add typed Post interface, fix sql injection

[cs01]

Summary

• Add Post interface and parsePost() helper to replace brittle positional indexing (parts[0]...parts[3]) with typed field access (post.id, post.title, post.url, post.points)
• Fix SQL injection in upvote handler by switching from string concatenation to parameterized query (sqlite.exec(db, "...WHERE id = ?", [idStr]))
• Pipe-delimited parsing is isolated to parsePost() — when a first-class sqlite.allObjects() API lands, only that one function changes

Test plan

• npm run build — TypeScript compiles cleanly
• npm test — all compiler tests pass (changes are example-only, no compiler code touched)
• Manual: chad build examples/hackernews/app.ts && ./app — serves correctly, upvote works