fix(security): close backend merge blockers

tests/unit/test_wndb_query_safety.py

@@ -0,0 +1,21 @@
+from app.native.wndb import s2_junctions
+
+
+def test_get_junction_binds_untrusted_identifier(monkeypatch) -> None:
+    calls: list[tuple[str, str, tuple[str, ...]]] = []
+    malicious_id = "J-1'; DELETE FROM junctions; --"
+
+    def fake_try_read(name, statement, params):
+        calls.append((name, statement, params))
+        return None
+
+    monkeypatch.setattr(s2_junctions, "try_read", fake_try_read)
+
+    assert s2_junctions.get_junction("project_a", malicious_id) == {}
+    assert calls == [
+        (
+            "project_a",
+            "select * from junctions where id = %s",
+            (malicious_id,),
+        )
+    ]