List endpoints fail on columns named after SQL keywords

List endpoints write filter and sort_by column names unquoted into the SQL query. Some columns are SQL keywords: flow_params.order and flow_params.values.

GET /api/flow_params?sort_by=order&order=asc builds ORDER BY order asc, and a values filter builds values ILIKE $1: both are SQL syntax errors, returned as 500.

Expected: column names are quoted in the generated query, so these requests succeed.