feat(core): add parameterized query interface to database_backend

[kcenon]

What

Summary

Adds select_prepared() and execute_prepared() virtual methods to the database_backend interface, establishing the foundation for wire-level prepared statement support. Default implementations fall back to string interpolation for backward compatibility.

Change Type

• Feature (new functionality)

Affected Components

• database/core/database_backend.h — New virtual methods + fallback helpers

Why

Problem Solved

All SQL execution currently relies on string-level escaping via value_formatter to prevent SQL injection. This PR establishes the interface for true parameterized queries where SQL and values travel separately. The default fallback ensures zero breakage for existing backends — they compile without changes.

Related Issues

• Part of [Security] Implement wire-level prepared statements instead of string escaping #557 (Phase 1 of 3)
• Phase 2 (backend overrides with native libpq/sqlite3 prepared statements) will follow
• Phase 3 (wire unified_database_system to use prepared path by default) will follow

Where

Files Changed

File	Type of Change
database/core/database_backend.h	Add select_prepared, execute_prepared, expand_params, value_to_sql
docs/README.kr.md	Fix pre-existing broken markdown anchors

How

Implementation Details

New virtual methods (with default fallback):

[[nodiscard]] virtual Result<database_result> select_prepared(
    const std::string& query,
    const std::vector<database_value>& params);

[[nodiscard]] virtual VoidResult execute_prepared(
    const std::string& query,
    const std::vector<database_value>& params);

Fallback mechanism:

• expand_params() substitutes $N (PostgreSQL, reverse order to avoid $1/$10 collision) and ? (SQLite, left-to-right)
• value_to_sql() converts database_value variant to SQL literal with basic escaping

Future override pattern (Phase 2):

// In postgresql_backend:
Result<database_result> select_prepared(...) override {
    // Use pqxx::work::exec_params() for native binding
}

Breaking Changes

None — new methods have default implementations. Existing backends compile without modification.

Test Plan

• CI verification: existing tests pass with new interface methods
• Phase 2 will add prepared-statement-specific tests per backend

[github-actions]

Benchmark Results

No comparison reports available. Baseline may not be established yet.