Narnes and Bobles & Bobles and Narnes LA CTF 2026 Bun Type-Confusion Javascript Sqlite Web Two type confusion bugs in a Bun bookstore: string price NaN trick, then batch INSERT column inference.