hardening: migrate flowview process/version lookups to prepared

[somethingwithproof]

Summary

Implements issue #247 by migrating selected raw process/version lookups to prepared database helpers.

Changes

• flowview_devices.php
  • converted process PID lookup in save_device() to db_fetch_cell_prepared()
  • converted process PID lookup in restart_services() to db_fetch_cell_prepared()
• setup.php
  • converted plugin version lookup in plugin_flowview_check_config() to db_fetch_cell_prepared()
  • converted process PID lookup in flowview_global_settings_update() to db_fetch_cell_prepared()
• added regression test: tests/test_prepared_statements.php

Validation

• php -l flowview_devices.php
• php -l setup.php
• php -l tests/test_prepared_statements.php
• php tests/test_prepared_statements.php

Issue

Closes #247

[Copilot]

Pull request overview

Updates FlowView plugin code to replace raw SQL string queries with prepared statements, and adds a lightweight regression test to detect reintroduction of those raw lookups.

Changes:

• Converted plugin version lookup in setup.php to db_fetch_cell_prepared() with a bound placeholder.
• Converted FlowView master process PID lookups in setup.php and flowview_devices.php to db_fetch_cell_prepared() with bound placeholders.
• Added a PHP test script that scans source files to assert prepared-statement usage and absence of specific raw lookups.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
tests/test_prepared_statements.php	Adds string-based regression checks to enforce prepared-statement usage for specific queries.
setup.php	Replaces raw db_fetch_cell() lookups with db_fetch_cell_prepared() for plugin version and PID retrieval.
flowview_devices.php	Replaces raw PID lookups with prepared statements for save/restart service paths.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

[somethingwithproof]

Addressed in 3a1079c: switched raw-process negative checks to regex patterns that also catch multi-line/raw formatting variants.

[somethingwithproof]

Addressed in 3a1079c: replaced exact formatting assertions with regex-based checks to reduce whitespace/format coupling.

[somethingwithproof]

Incorporated follow-up review feedback in da408cb. Added follow-up checks to verify process lookups bind flowview/master via placeholders in both setup and device paths.