hardening: migrate gexport SQL helpers to prepared variants

[somethingwithproof]

Summary

• migrate selected plugin_gexport SQL helper call sites to prepared variants
• convert export deletion action to parameterized IN (...) prepared delete
• convert list record/count and running-state queries to prepared fetch helpers
• convert setup poller and plugin version lookups to prepared helpers
• parameterize site/tree name aggregation queries from validated ID lists

Tests

• php -l gexport.php
• php -l setup.php
• php -l tests/test_prepared_statements.php
• php tests/test_prepared_statements.php

Closes #66

[Copilot]

Pull request overview

This PR hardens the plugin_gexport database access paths by migrating remaining raw SQL helper call sites (db_fetch_*, db_execute) to prepared/parameterized variants to reduce SQL injection risk and standardize query patterns.

Changes:

• Updated setup.php poller + upgrade checks to use db_fetch_*_prepared helpers.
• Converted gexport.php export deletion to a parameterized IN (...) prepared delete and migrated list/count + running-state queries to prepared fetch helpers.
• Added a lightweight regression script to verify prepared helper usage in touched files.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/test_prepared_statements.php	Adds regression checks to ensure prepared helper usage is present at key call sites.
setup.php	Replaces raw exports query and plugin version lookup with prepared variants.
gexport.php	Parameterizes bulk delete, count/list queries, running-state query, and site/tree name aggregation queries.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[somethingwithproof]

Addressed in 2361e7e: added explicit readability assertions for both source files and only then run regex/substring assertions.

[somethingwithproof]

Incorporated follow-up feedback in 3f6b043. Added follow-up checks for guarded bulk-delete behavior and placeholder construction from export-id count.