node:sqlite: backup() unwraps any object as a DatabaseSync, and a duck-typed URL aborts the process

Version

v27.0.0-pre (884f9cd62da)

Platform

Darwin 25.6.0 arm64

Subsystem

sqlite

What steps will reproduce the bug?

node:sqlite's backup() checks that its first argument is an object, then unwraps it. Passing anything other than a DatabaseSync results in a crash:

const { backup } = require('node:sqlite');
backup({}, '/tmp/c1a.db');

Similarly, the DatabaseSync constructor treats any object as a URL if it has a string href. If that href doesn't parse, it crashes:

const { DatabaseSync } = require('node:sqlite');
new DatabaseSync({ href: 'zzz' });

How often does it reproduce? Is there a required condition?

It's consistent.

What is the expected behavior? Why is that the expected behavior?

Both should raise a TypeError.

What do you see instead?

A segfault.

Additional information

No response

Start with the node:sqlite implementations of backup() and the DatabaseSync constructor, then reproduce both examples from the issue. The work is done when invalid backup arguments and malformed URL-like objects raise TypeError instead of causing a segfault, with regression coverage for both cases.