Wire up live <mysql> for vst/modular1/modular1_patches, without <database>

<database> was SESSIONCTL.tag's own JET-1.4-only concept - the new JetCore
port never implemented it. The real, dispatched tag for opening a MySQL
connection is <mysql> (confirmed in Tag.cpp's dispatch chain), so these 3
product pages - the ones deferred in the previous conversion pass because
they pull live rows via <sql> - now wrap their content in a real
<mysql host="localhost" database="barant" user="barant" password="...">
matching barant.com's own config.cfg, with <retain> (a SESSIONCTL-only
form-echo helper with no analog here) stripped.

host="localhost" is correct per config.cfg but only reachable from
barant.com itself - a locally-run .jtc genuinely cannot connect from here.
That's intentional: the connection fails at runtime exactly as if the
database were down, and APIServer's existing catch(coreutils::Exception)
path (ApiSession.cpp) already turns that into a clean 500 rather than a
crash - verified live: all 3 pages return HTTP 500 with mysql's own
"database and host parameters are not valid." message, and the server
process stays up and responsive throughout.

The real DB password is deliberately not a literal in this file - it's
read from BARANT_DB_PASSWORD at conversion time, and the resulting .jet
output for these 3 pages is gitignored rather than committed, so the
credential never enters git history even though it does end up baked into
the locally-generated, locally-deployed .jtc.

jetc/barant-site/convert.py

@@ -113,6 +113,34 @@ def strip_setenv(html):
     return re.sub(r'<setenv\s+name="[^"]*">.*?</setenv>', '', html, flags=re.IGNORECASE | re.DOTALL)
 
 
+def strip_retain(html):
+    """<retain name="X"> is a SESSIONCTL.tag helper that echoes a posted form
+    field back as a hidden input - meaningless with no <form>/session in this
+    static conversion, and (since it isn't a tag jetc's fallback interpreter
+    knows about) would otherwise render as literal untouched text rather
+    than erroring, which is worse than just dropping it."""
+    return re.sub(r'<retain\s+name="[^"]*"\s*>', '', html, flags=re.IGNORECASE)
+
+
+# Pages that need a live product-row lookup - <database> (SESSIONCTL-only,
+# not implemented by the new JetCore port) is replaced with the real
+# <mysql> tag it should have used all along. host="localhost" matches
+# barant.com's own config.cfg verbatim: MySQL is only reachable from the
+# server itself, so a locally-run .jtc genuinely can't connect here - by
+# design, per instruction, this fails at runtime exactly as if the
+# database were down, and APIServer's existing catch(coreutils::Exception)
+# path (ApiSession.cpp) already turns that into a clean 500, not a crash.
+#
+# The real credential is deliberately NOT a literal here - it's supplied
+# via the BARANT_DB_PASSWORD env var at conversion time, since the .jet
+# files this produces for these pages get gitignored rather than committed
+# (see .gitignore) precisely so the password never lands in git history.
+MYSQL_PAGES = {"vst", "modular1", "modular1_patches"}
+DB_PASSWORD = os.environ.get("BARANT_DB_PASSWORD", "")
+MYSQL_OPEN = '<mysql host="localhost" database="barant" user="barant" password="%s" sessionid="">' % DB_PASSWORD
+MYSQL_CLOSE = '</mysql>'
+
+
 def selfclose_set(html):
     """Old JET shorthand allows <set name="x" value="y"> with no closing tag
     and no container - jetc's own real <set> codegen requires this to be
@@ -209,11 +237,15 @@ def convert_page(name):
     contents = contents_m.group(1)
 
     contents = strip_setenv(contents)
+    contents = strip_retain(contents)
     contents = selfclose_set(contents)
     contents = flatten_sectionframes(contents)
     contents = flatten_linkbuttons(contents)
     contents = resolve_images(contents)
 
+    if name in MYSQL_PAGES:
+        contents = MYSQL_OPEN + contents + MYSQL_CLOSE
+
     if name == "jet":
         # jet.page dispatches on a $[ARGS] query-string sub-page selector
         # (?tags, ?set, etc. -> jet_<sub>.section) - that request-derived