docs(CLAUDE.md): Update configuration table and add Gotchas section

- Fix defaultPageSize value (500, not 1000)
- Add queryTimeout and maxUndoMemory settings
- Add Gotchas section documenting common issues:
  - SQL security (LIKE wildcards, type validation, NUL bytes)
  - RPC serialization (Uint8Array, Transfer wrapper)
  - Testing (VS Code mocks, JSON patch tests)
  - Build (WASM location, browser vs Node detection)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: zknpr

CLAUDE.md

@@ -296,9 +296,30 @@ Settings in `package.json` → `contributes.configuration`:
 |---------|---------|-------------|
 | `sqliteExplorer.maxFileSize` | 200 | Max file size in MB (0 = unlimited) |
 | `sqliteExplorer.maxRows` | 0 | Max rows to display (0 = unlimited) |
-| `sqliteExplorer.defaultPageSize` | 1000 | Default page size for pagination |
+| `sqliteExplorer.defaultPageSize` | 500 | Default page size for pagination |
 | `sqliteExplorer.instantCommit` | "never" | Auto-save strategy (always/never/remote-only) |
 | `sqliteExplorer.doubleClickBehavior` | "inline" | Double-click action (inline/modal/vscode) |
+| `sqliteExplorer.queryTimeout` | 30000 | Query execution timeout in ms (prevents runaway queries) |
+| `sqliteExplorer.maxUndoMemory` | 52428800 | Max undo history memory in bytes (default 50MB) |
+
+## Gotchas
+
+### SQL Security
+- **LIKE wildcards**: User input in LIKE queries must use `escapeLikePattern()` with `ESCAPE '\\'` clause
+- **SQL types in DDL**: Always validate with `validateSqlType()` to prevent injection via malicious type strings
+- **NUL bytes**: Strings containing `\0` must be encoded as hex blobs in exported SQL
+
+### RPC Serialization
+- **Uint8Array becomes `{}`**: Never send raw Uint8Array via postMessage - use the marker format
+- **Transfer for blobs**: Large binary data should use `Transfer` wrapper for zero-copy
+
+### Testing
+- **VS Code mocks required**: Unit tests need `tests/mocks/vscode.ts` imported first
+- **JSON patch tests**: Test behavior (merged result) not implementation (SQL function)
+
+### Build
+- **WASM not found**: Run `node scripts/build.mjs` if `assets/sqlite3.wasm` is missing
+- **Browser vs Node**: Check `import.meta.env.VSCODE_BROWSER_EXT` for environment-specific code
 
 ## Extension Identifiers