Fix three critical bugs in ConnectionProfile and MSSQL driver

- Declare `password` as a proper dataclass field (repr=False) so it is
  visible to type checkers and any code path that constructs a bare
  ConnectionProfile; drop the now-unused Optional import.
- Fix _conn_str() fallback loop: the return was inside the for-body,
  so only ODBC Driver 18 was ever tried. Now uses pyodbc.drivers() to
  pick the first installed driver from the preference list.
- Make _cur() a thread-safe @contextmanager that holds self._lock for
  the cursor's lifetime, matching MySQL/PostgreSQL/SQLite. Updated all
  16 call sites to `with self._cur() as c:`.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/models/connection_model.py

@@ -2,7 +2,6 @@
 Connection profile dataclass and registry.
 """
 from dataclasses import dataclass, field
-from typing import Optional
 import uuid
 
 
@@ -14,6 +13,7 @@ class ConnectionProfile:
     port: int = 3306
     database: str = ""
     username: str = ""
+    password: str = field(default="", repr=False)
     color: str = "#89b4fa"
     id: str = field(default_factory=lambda: str(uuid.uuid4()))
     ssl: bool = False