feat(backends): implement native prepared statements for PostgreSQL and SQLite

[kcenon]

What

Summary

Implements native wire-level prepared statement support in PostgreSQL and SQLite backends by overriding select_prepared() and execute_prepared() from the base interface added in PR #559.

Change Type

• Feature (new functionality)

Affected Components

• database/backends/postgresql_backend.h/.cpp — Native prepared statement overrides
• database/backends/sqlite_backend.h/.cpp — Native prepared statement overrides
• tests/security/sql_injection_test.cpp — Prepared statement injection tests

Why

Problem Solved

Phase 1 (#559) added the prepared statement interface with string-interpolation fallback. This Phase 2 PR replaces the fallback with true wire-level parameter binding, providing defense-in-depth against SQL injection.

Related Issues

• Part of [Security] Implement wire-level prepared statements instead of string escaping #557 (Phase 2 of 3)
• Depends on feat(core): add parameterized query interface to database_backend #559 (merged — Phase 1 interface)
• Phase 3 will wire unified_database_system to use prepared path by default

Alternative Approaches Considered

1. Template-based parameter packs — Rejected for ABI stability with virtual interface
2. Separate prepared_statement object — Deferred to Phase 3 if caching is needed

Where

Files Changed

File	Type of Change
database/backends/postgresql_backend.h	Add override declarations
database/backends/postgresql_backend.cpp	Implement select_prepared/execute_prepared via pqxx and libpq
database/backends/sqlite_backend.h	Add override declarations
database/backends/sqlite_backend.cpp	Implement via sqlite3_prepare_v2/sqlite3_bind_*
tests/security/sql_injection_test.cpp	5 new tests for prepared statement path

How

Implementation Details

• PostgreSQL (pqxx): Uses pqxx::params + pqxx::work::exec_params() for wire-level binding
• PostgreSQL (libpq): Uses PQexecParams() with paramValues array, letting server infer types
• SQLite: Uses sqlite3_prepare_v2() → type-specific sqlite3_bind_*() → sqlite3_step()
• Mock mode: Falls back to base class string interpolation when backends are not compiled
• All implementations follow existing error handling patterns (Result<T>, VoidResult)

Testing Done

• 5 new prepared statement security tests added
• Tests cover: correct results, injection blocking, typed params, batch injection, NULL handling
• Existing tests unaffected (prepared methods are additive overrides)

Test Plan

1. Run ctest --output-on-failure — all tests should pass
2. Verify PreparedSelectBlocksInjection passes (injection treated as literal)
3. Verify PreparedBatchStatementInjectionBlocked passes (table survives)

Breaking Changes

None — additive overrides only, existing execute_query/select_query unchanged

[github-actions]

Benchmark Results

No comparison reports available. Baseline may not be established yet.